fix: require setuptools>=83 and milvus-lite>=3.0 (CVE-2026-59890)

[j-sperling]

Summary

• The setuptools>=78.1.1,<81 pin (added for PYSEC-2025-49) now blocks upgrading past CVE-2026-59890, which is fixed in setuptools 83, so every memsearch install resolves a vulnerable setuptools.
• The <81 cap exists because milvus-lite 2.5.x imports pkg_resources, which setuptools 83 removes. milvus-lite 3.0 drops that import, so the two floors have to move together: setuptools>=83 paired with milvus-lite>=3.0.
• Behavior note: milvus-lite 3.0 no longer persists collection descriptions, so the description round-trip test now accepts write-only behavior. The lock also floats torch to 2.13 in the local extra because torch 2.12.1 pins setuptools<81.
• Migration caveat worth calling out in release notes: milvus-lite 3.x cannot read .db files from the 2.5.x storage format (already covered by the "Milvus Lite collection is released" troubleshooting entry — users rebuild from source markdown).

We have been running this combination without issues.

Test plan

• Full suite: 264 passed, 7 skipped on this branch with setuptools 83 + milvus-lite 3.0 resolved
• ruff check / ruff format --check clean
• uv lock regenerated from the new floors; uv lock --check clean
• Existing indexes rebuilt and searched against milvus-lite 3.0 in daily use

[j-sperling]

Merged current main (c0984a0) to clear the conflict: kept main's new pathspec>=0.12 alongside the raised setuptools>=83 floor, and regenerated uv.lock from the merged base (uv lock --check clean, resolved versions match main where untouched — e.g. pathspec 1.0.4). Full suite passes locally (291 passed, 7 skipped) with milvus-lite 3.0 actually exercising the Lite path.

Two things worth an explicit ack in review, both consequences of the floor change rather than incidental churn:

1. Storage-format break: milvus-lite 3.x cannot read 2.5.x .db files. Markdown remains the source of truth and a re-index rebuilds the store, but this may warrant a minor (0.5.0) rather than patch release plus a release-note entry.
2. Forced torch bump in the local extra: torch ≤2.12.1 pins setuptools<81, which is incompatible with the new floor, so the lock moves torch to 2.13.0 (CUDA-13 nvidia stack). This is the migration Upgrade dependencies carrying published security advisories #655 deliberately deferred; here it is unavoidable.