* chore(deps): consolidated dependency bump

Combine six open Dependabot PRs into one bump and regenerate both
lockfiles so they resolve together:

- requests 2.33.1 -> 2.34.2 (#3098)
- ansible-core 2.21.0 -> 2.21.1 (#3097)
- redis 7.4.0 -> 8.0.1 (#3096)
- djangorestframework-stubs 3.16.9 -> 3.17.0 (#3095)
- django-stubs-ext 6.0.5 -> 6.0.6 (#3094)
- tailwindcss + @tailwindcss/cli 4.3.1 -> 4.3.2 (#3104)

redis is a major bump. kombu 5.6.2 caps its optional redis extra at
<6.5, but we depend on redis-py directly, so the cap is not enforced.
Verified against a live redis that the direct client API (get/set/
rpush/blpop/pubsub), the celery->redis broker enqueue path, and the
channels-redis channel layer all work with redis-py 8.0.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* chore(deps): sync workflow requests pin, drop redundant types-requests

Address Copilot review on the consolidated bump:

- Bump the hardcoded requests pin in build-balena-disk-image.yaml
  (rpi-imager.json generation) to 2.34.2 to match pyproject.
- requests 2.34.2 now ships py.typed, so the types-requests stub in
  the dev-host group is redundant; remove it and relock. The inline
  types are stricter and surfaced a latent bytes/str inconsistency in
  handle_github_error's errdesc, now annotated as bytes | str.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* ci: build rpi-imager.json via uv + lockfile instead of an ad-hoc pin

The build-rpi-imager-json job installed requests with a hardcoded
`pip install 'requests==X'`, a pin that had to be hand-synced with
pyproject.toml (and had already drifted). Replace it with the pinned
astral-sh/setup-uv action and `uv run --locked --group local`, which
resolves requests from uv.lock and fails the job if pyproject and the
lockfile ever diverge. Removes the drift source permanently.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* ci: validate rpi-imager.json with jq empty instead of jq .

jq empty asserts the file is well-formed JSON and exits non-zero on
failure without dumping the payload to the build log; jq . only
pretty-printed it as a side effect of parsing.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* fix(github): log decoded response text, not raw bytes

handle_github_error logged exc.response.content (bytes), which renders
as a b'...' repr in the log line. Use .text so the GitHub error body
reads as the server's actual message and errdesc stays a plain str.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>