fix(deps): pin anyio==4.14.2 to clear CVE-2026-63374 / CVE-2026-64847 (#511)

`uv run pip-audit` (the `audit` CI job) started failing against an unchanged
lockfile: both advisories are against anyio 4.13.0 and are fixed in 4.14.2.
pip-audit queries a live advisory database at run time, so the job flipped red
with no dependency change on our side — main passed at 15:52 today and PR #508
failed at 19:51 with an identical lockfile.

anyio is transitive (openai -> httpx -> anyio), so there is nothing to bump
upstream; the pin follows the pattern already used in this file for urllib3 and
for the filelock/virtualenv/pip CVE floors in the dev extra.

Only anyio moves: the lockfile diff contains exactly one version change, the
rest is that package's wheel hashes.

Author: arekay-nv

pyproject.toml

@@ -98,6 +98,10 @@ dependencies = [
     "pytz==2026.1.post1",
     "urllib3==2.7.0",
     "pyyaml==6.0.3",
+    # anyio is pulled in transitively (openai -> httpx -> anyio); pinned here to
+    # force past CVE-2026-63374 / CVE-2026-64847 (both fixed in 4.14.2), which
+    # otherwise fail `uv run pip-audit`.
+    "anyio==4.14.2",
 ]
 
 [project.optional-dependencies]