chore(deps): aggregate envs Dependabot updates

[cursor]

Summary

Aggregates the remaining open envs/ Dependabot updates into one PR, and carries unpublished lockfile security bumps from #1015 / #1131 so they are not dropped.

New open Dependabot PRs included:

• chore(deps): bump tornado from 6.5.6 to 6.5.8 in /envs/coding_env #1114 — envs/coding_env: tornado 6.5.6 → 6.5.8 (security hardening)
• fix: textarena nltk compatibility #1116 — envs/textarena_env: nltk 3.9.4 → 3.10.3 (lower bound nltk>=3.10.0)

Already on main (from fda3603e); close the singles, nothing left to land:

• chore(deps): bump tornado from 6.5.7 to 6.5.8 in /envs/wildfire_env #1115 — envs/wildfire_env tornado 6.5.8
• chore(deps): bump pypdf from 6.14.2 to 6.16.1 in /envs/repl_env #1117 — envs/repl_env pypdf 6.16.1

Also included from #1015 / #1131 (still not on main):

• cryptography → 50.0.0 in calendar, carla, chat, opencode, pelican_svg, pi, qed_math, sophistry_bench_sprint, sumo_rl, terminus, websearch, agent_world_model, wildfire
• aiohttp → 3.14.3 in agent_world_model, finrl, openapp, qed_math, sophistry_bench_sprint
• h2/hpack in coding_tools_env, nltk in openapp_env, pyjwt in tbench2_env, pillow in websearch_env

repl_env files are left untouched so we do not regress the pypdf>=6.16.1 lower bound already on main.

This supersedes #1015 and #1131.

Core Dependabot status (no second mergeable PR today):

• chore(deps): aggregate openenv-core Dependabot updates #1130 already merged the non-env doc-builder pins onto main.
• chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1119 (FastMCP >=3.0.0,<5.0.0 → 4.0.3) still fails MCP session persistence on current main (inc_counter returns 1 on the second HTTP and WebSocket call). Kept out of any easy-merge aggregate; leave chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1119 open.
• chore(deps): aggregate non-env dependabot updates #1109 is superseded by chore(deps): aggregate openenv-core Dependabot updates #1130 and conflicts with main.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring
• Dependency updates (envs only)

Alignment Checklist

Before submitting, verify:

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated (envs lockfiles only; no agent-facing reset/API changes)
• uv lock --check passed in every updated env

RFC Status

• Not required (bug fix, docs, minor refactoring)
• RFC exists: #___
• RFC needed (will create before merge)

Test Plan

• git diff --check origin/main...HEAD
• Scope is envs/**/uv.lock plus envs/textarena_env/pyproject.toml
• uv lock --check in each updated environment: pass
• No src/ or root pyproject.toml changes

Claude Code Review

N/A — Dependabot lockfile rollup.

This automation cannot close PRs (GitHub token returns 403). Please close these superseded PRs:

• Dependabot singles: chore(deps): bump tornado from 6.5.6 to 6.5.8 in /envs/coding_env #1114, chore(deps): bump tornado from 6.5.7 to 6.5.8 in /envs/wildfire_env #1115, fix: textarena nltk compatibility #1116, chore(deps): bump pypdf from 6.14.2 to 6.16.1 in /envs/repl_env #1117
• Older aggregates: chore(deps): aggregate envs dependabot updates #1015, chore(deps): aggregate non-env dependabot updates #1109
• Keep open: chore(deps): update fastmcp requirement from <4.0.0,>=3.0.0 to >=3.0.0,<5.0.0 #1119 (blocked FastMCP 4 upgrade)