fix: upgrade pip to 26.1.2 to resolve PYSEC-2026-196

[opratr]

Summary

• Bumps pip from 26.1.1 to 26.1.2 in uv.lock
• Resolves PYSEC-2026-196, a known vulnerability in pip flagged by pip-audit in CI
• pip enters the lockfile as a transitive dependency via pip-audit → pip-api → pip

Why this is needed

Both open Dependabot PRs (#8 and #9) are failing the Security: dependency audit (pip-audit) CI step because main itself carries this vulnerable pip version. Fixing it here unblocks those PRs.

Merge order after this lands:

1. This PR (pip fix)
2. Rebase and merge PR build(deps): bump msgpack from 1.1.2 to 1.2.1 in the uv group across 1 directory #9 (msgpack 1.1.2 → 1.2.1, fixes GHSA-6v7p-g79w-8964)
3. Rebase and merge PR build(deps): bump actions/checkout from 6 to 7 #8 (actions/checkout v6 → v7)

Test plan

• CI passes on this PR (pip-audit should find zero vulnerabilities)
• After merge, trigger rebase on PR build(deps): bump msgpack from 1.1.2 to 1.2.1 in the uv group across 1 directory #9 and PR build(deps): bump actions/checkout from 6 to 7 #8 via @dependabot rebase