chore(deps): repair original uv dependency group PR156 #161

Parent: https://github.com/MachineWisdomAI/WisdomHelm/issues/93
Merge when clean: yes

Repair ORIGINAL Dependabot PR156 #156 under existing routine maintenance authority. Duplicate checks Nov2 found no matching open source issue/root, zero active builders initially; existing SDK256 same-PR freshness repair is separately canonical. Do not take over local Laya/feature work.

Assess the actual five selected dependency ranges (certifi2026.1.4→2026.10.19, filelock3.25.1→4.2.1, nltk3.10.1→3.10.4, opentelemetry-api1.40.0→1.45.1, setuptools83.0.0→84.1.0) against official primary release/docs and FAVA's actual runtime/build inputs. Distinguish upstream major dependency compatibility from authorization for our own major release. If a concrete out-of-scope compatibility decision or verified incompatibility remains, report it rather than weakening behavior or blindly upgrading.

Read repo AGENTS/current reviewed component version policy. Normally integrate actual currentmain in the ORIGINAL bot branch, preserve all current source, run local scripts/mw-version.py updater against currentmain once as required by product classifier. Keep original authorship/branch; worker fast-forward only, no replacement/forcepush/merge/tag/publication/install/model/provider/bootstrap/config/credential changes. Run affected dependency consumer tests, package/runtime/MCP tests and required verifier with actual supported environment; no test weakening. Report exact repaired_pr head/base, selected-range primary evidence, tests, unresolved gaps and six-question audit. Finish source without waiting hosted CI; FirstOfficer independently reviews exact returned head and normal protected merge only after current approval/checks/rules/threads/freshness. Existing daily/Wed heartbeat continuation, no new watcher or queue. Max2maintenanceworkers; six-day source window/24h2000turnattempt/10repairs per existing policy.