deps: refresh compatible dependencies and align plugin launcher pins

[dependabot]

The dependency refresh now resolves against current main, keeps all generated requirements consistent, and makes the plugin launcher install the same MCP and Pydantic versions as the lockfile. Relative to main, it updates 33 packages and adds cloudpickle, required by joblib.

Two original requested versions cannot resolve with this project's dependencies:

• Pydantic 2.13.5 requires pydantic-core 2.46.5, so the refresh uses that pair instead of Core 2.48.0.
• datasets 5.0.1 requires fsspec <=2026.6.0. fsspec stays at 2026.6.0; benchmark dependencies and supported Python versions are preserved.

The generated googleapis-common-protos conflict resolves to 1.75.3. C# extractor fixtures now use csharp, the canonical grammar name already used by the production registry; the new language pack no longer resolves the old c_sharp alias. All AST assertions are preserved. The Linux CPU-only Torch selection is unchanged.

Validation on 99d2a1fd (macOS ARM64, Python 3.12.11, uv 0.11.3, private test data):

• Lock and all 13 generated-export checks pass.
• Ordered Ruff, format (1,448 files), craftsmanship and Pyright gates pass.
• Affected core/server/handler/infrastructure/script layers: 6,525 passed, 149 PostgreSQL skips, 348 subtests.
• Full suite: 7,697 passed, 221 PostgreSQL skips, 361 subtests, 151.98 seconds.

The original full run exposed the launcher pin drift and eight grammar-alias failures; both causes are corrected. A separate test-state mismatch was resolved by preparing a private dependency directory matching the candidate venv, with the same assertions. PostgreSQL-dependent tests still need their GitHub CI jobs.

Actual MiniLM comparison against main uses the same Python 3.12.11, pinned model, and 32 public synthetic texts. All token IDs and every scalar/batch vector byte match across four paired runs (first discarded). This is a scoped compatibility check, not a full retrieval-quality result.

The complete retrieval reference on main 6ec76a0 already fails three published LongMemEval/LoCoMo floors. This dependency refresh does not claim to fix those failures or the separate W3–W5 remediation acceptance gaps. GitHub CI now passes on this exact head, including Python 3.10–3.13, Windows, SQLite and the hook-free MCP host contract. SQLite reports 7,646 passed, 127 skipped and 361 subtests; all six Claude Code/Gemini CLI/Codex CLI full/lean protocol probes pass. The first SQLite job hit its ten-minute limit while still progressing; the same-head rerun completed pytest in 185.06 seconds, with no change to tests or timeouts. The initial runtime outlier remains unexplained.