chore: move to laithalsaadoon, fix red CI, roll up dependencies (2026-09-11)

[laithalsaadoon]

One maintenance pass after the repository moved from theagenticguy to laithalsaadoon: the rename in every tracked file, the three CI jobs that were red on main, and a dependency rollup across the Python closure, the mise toolchain, the docs site, and the workflow actions.

Repository move

Every theagenticguy reference in tracked files now reads laithalsaadoon (21 files: [project.urls] in the root and all seven member manifests, README badges, SECURITY.md, CODEOWNERS, issue templates, RELEASING.md, lychee's user agent, the OpenVEX @ids, site/src/lib/repo.ts, Head.astro, and robots.txt). git grep theagenticguy returns nothing. The built site's sitemap and robots.txt emit https://laithalsaadoon.github.io/atif-sql.

Two live settings changed outside the PR, both on the repository itself: the homepage URL now points at https://laithalsaadoon.github.io/atif-sql/, and Dependabot alerts (which carry the dependency graph) are enabled again. The graph had come back disabled after the transfer, which is why dependency-review-action failed on every PR with "Dependency review is not supported on this repository".

Still outside this PR's reach: the PyPI trusted publisher (publish.yml) names the repository owner, so if a pending publisher was registered under the old owner it must be re-registered. atif-sql is not on PyPI yet, so nothing is broken today.

CI fixes

• links.yml: lychee.toml never loaded under lychee-v0.24.2 (every run since 2026-08-28 failed on the config, not on a link). Two [hosts.*] tables sat above six top-level keys, so TOML folded accept, method, cache, user_agent into the last host entry; the tables now close the file. accept and method take a single string in this version, not a list. site/authored/ is excluded: its root-relative /agents/ and /llms*.txt links point at built routes that starlight-links-validator checks in docs:gate. Probed locally: config loads, 129 links OK online, 0 errors offline.
• security.yml (scheduled 2026-09-08): mise-action fetched the just-cut mise v2026.9.3 whose tarball had not been uploaded yet, 404'd five times, and skipped every scanner. All six mise-action uses now pass minimum_release_age: 24h; version stays unpinned.
• dependency-review.yml: fixed by the live setting above; no file change.

Dependency rollup

Supersedes Dependabot #2 (python-minor-patch group, 9 updates) and #3 (uv_build <0.12 to <0.13); Dependabot closes both once this lands.

Python (uv lock --upgrade, no manifest range changes except the seven uv_build build requirements widened to <0.13):

package	from	to
anyio	4.14.2	4.15.1
boto3 / botocore	1.43.78	1.43.92
click	8.4.2	8.5.0
cloudpickle	—	3.1.2 (new transitive)
coverage	7.15.4	7.16.0
cryptography	50.0.0	50.0.1
cyclopts	4.23.2	4.25.2
filelock	3.32.3	3.32.6
grimp	3.15	3.17
huggingface-hub	1.28.0	1.31.0
hypothesis	6.165.10	6.168.0
import-linter	2.13	2.15
joblib	1.5.3	1.6.0
lance-namespace (+ urllib3 client)	0.11.1	0.12.0
lefthook	2.1.11	2.1.12
litellm	1.97.0	1.100.1
multidict	6.7.1	6.8.0
narwhals	2.25.0	2.26.0
numpy	2.5.2	2.5.3
platformdirs	4.11.3	4.11.8
polars (+ runtime-32)	1.43.2	1.44.2
pydantic / pydantic-core	2.13.4 / 2.46.4	2.13.5 / 2.46.5
pyjwt	2.13.0	2.14.0
regex	2026.7.19	2026.9.10
ruff	0.16.4	0.16.7
scikit-learn	1.9.0	1.9.1
tokenizers	0.23.1	0.23.2
tqdm	4.70.0	4.70.1
ty	0.0.74	0.0.80
typer	0.27.1	0.27.2
wcwidth	0.8.2	0.8.3
wrapt	2.3.0	2.4.1

ty 0.0.80 ships redundant-condition-strict, which fires on the runtime isinstance(payload, dict) guard in cohere_bedrock.py that pyright already suppresses; the line now carries the matching # ty: ignore.

mise toolchain (mise run tools:bump, mise.lock only):

tool	from	to
uv	0.12.1	0.12.12
semgrep	1.172.0	1.176.1
syft	1.43.0	1.51.1
grype	0.111.1	0.118.0
trivy	0.70.0	0.74.0
osv-scanner	2.5.0	2.5.1
zizmor	1.29.0	1.30.1
betterleaks	1.7.4	1.8.1
pyright	1.1.411	1.1.413
node	24.19.0	24.20.0

Docs site (site/package.json, exact pins): astro 7.2.9 → 7.3.2, @astrojs/starlight 0.41.10 → 0.42.0, @astrojs/markdown-satteri 0.3.8 → 0.4.1, starlight-links-validator 0.25.3 → 0.26.0. Left alone on purpose: typescript 5.9 → 7.0 and vitest 4 → 5 are majors and get their own PR.

Workflow actions: github/codeql-action v4.37.9 → v4.38.0 (four uses), actions/deploy-pages v5.0.0 → v5.0.1. Every other pinned action is already at its latest release.

Housekeeping: .lycheecache added to .gitignore (links.yml carries it via actions/cache).

Evidence

Run locally on this branch from a fresh worktree:

• mise run check (lint, fmt, ty, pyright, import-linter, actionlint, lefthook validate, vex drift, pytest): green
• mise run docs:gate (astro build, astro check, dist probes, vitest): green
• zizmor .github/workflows: no findings
• lychee --config lychee.toml --offline .: 0 errors; online run: 129 OK, 0 errors, 3 redirects
• mise run security was NOT run locally; the PR's security workflow covers it