fix(deps): patch certifi and Pillow across locked environments - #162

Purpose

Closes #163. Extend the original Dependabot certifi update to all affected root/development and comparison locks. Preserve the original Dependabot commit as an ancestor.

Changes

• Regenerate locks to certifi2026.10.19 and Pillow13.0.0. All other package records, framework commits, markers and numerical dependencies remain unchanged.
• Reuse existing licensed package metadata strictly offline for the two VectorBT Pro lock regenerations. No licensed authentication or permission change.
• Retain original benchmark samples and frozen environments. The explicit impact review records that CA-store validation and image decoding are outside all17 timed engine-only workloads. Current source and runner bytes are unchanged; correctness retains its actual original provenance.

Verification

• Parsed every lock diff: only certifi/Pillow package records changed; Backtrader lock was already unaffected.
• Locked root development/docs installation, ordinary commit hooks and complete repository hooks pass.
• Full exported-dependency pip-audit base/fix verification, documentation and current-head hosted platform/package/security checks are being completed. No suppression or weaker gate.

AI assistance

OpenAI Codex assisted review, lockfile regeneration and validation under maintainer direction. Original Dependabot contribution and commit are retained.