fix: qualify secure dependencies with current Specs - #57

Restore a vulnerability-free contributor environment and compatibility with the currently released Specs package. This extends the original Dependabot update in its existing owning dependency PR.

• Retain the original urllib3 2.8.0 update and its Dependabot commit.
• Upgrade vulnerable virtualenv 21.7.1 to 21.14.8 and its required packaging/python-discovery dependencies. Other locked package versions remain unchanged; use CI's uv 0.10.9 and preserve every audit gate.
• Serialize FeedSpec through its public to_dict contract when available, retaining the old dataclass fallback. Newly released Specs 0.2.0 otherwise leaks the default time_contract_version=1 field into ordinary legacy mappings. This is the minimal current-dependency compatibility prerequisite extracted from fix: preserve calendar intent through model feed handoffs #62; explicit calendar=None behavior and the broader temporal contract remain separately reviewed there under Preserve calendar declaration intent through model-to-feed handoffs #61.

Verification at 1aae3c3:

• uv lock --check and native Ruff/format/ty/full pytest hooks pass: 422 tests, zero failures/skips.
• The real public default-mapping test fails at 1401715 with published Specs 0.2.0, then passes with the serialization correction. The failure was first observed in the actual installed-wheel hosted workflow; the same sole compatibility failure was confirmed across the numerical PR's nine installed-wheel platform cells.
• A fresh built wheel passes all 382 applicable tests outside the source checkout with current declared dependencies, including Specs 0.2.0. No expected output was weakened to accept the leaked field.
• The installed contributor-environment audit covers 115 packages with zero known vulnerabilities. The earlier fully pinned exported-lock audit also found none. Lock identity is unchanged by the compatibility correction, so that audit evidence is retained.

Current-head hosted platform/package and current/minimum audit checks must pass before ordinary protected integration. No advisory exclusions, skipped failures, protection changes or release requested.

AI assistance: Codex reviewed the dependency changes, reproduced the remaining audit/compatibility failures, generated the lock repair, added the minimal public-serialization correction and ran verification. Automated dependency exception applies; the remaining calendar implementation has its own issue/PR.