#464 [misc] fix: update dependencies for security advisories

What

• Resolve the 11 open Dependabot alerts (#152–162) with Strands 1.59.0, LiteLLM 1.103.1, filelock 4.2.1, virtualenv 21.14.13, and OpenTelemetry 1.45.1. Update the required OpenTelemetry and AWS dependency families in the lockfile.
• Enforce the security bounds in each owning extra and the development group, including exclusion of vulnerable LiteLLM 1.104.0rc1. Keep optional import hints and wheel metadata checks aligned.
• Extend the existing dependency-security cases to reject vulnerable locked and published versions, including prereleases. Make the tunnel cancellation test independent of OS process-start latency and always clean up its subprocess.

Why

Dependabot reports vulnerabilities in the locked versions, and the previous published bounds still allow them. Raising bounds only in the owning features protects ordinary wheel installs without expanding the base installation. Strands 1.59.0 admits the patched LiteLLM version; earlier inspected Strands releases cap LiteLLM below the fix.

How to Test

Validated locally on Python 3.13.5 after uv sync --locked --all-extras --group dev:

• python -m pytest -q tests/unit/test_dependency_security.py tests/unit/test_public_api_imports.py: 62 passed.
• UV_CACHE_DIR=/private/tmp/osmosis-dependabot-oct27-uv-cache LITELLM_LOCAL_MODEL_COST_MAP=True python -m pytest -q --maxfail=5 --tb=short --disable-warnings --durations=10: 4,080 passed, 1 optional NumPy-scalar test skipped because NumPy is not installed. Upstream deprecation warnings remain.
• ruff check --no-cache ., ruff format --check --no-cache ., ty check --error-on-warning osmosis_ai/, uv lock --check --offline --no-build --no-python-downloads, and git diff --check pass.
• uv run --locked --all-extras --group dev --no-editable pyright --pythonpath "$PWD/.venv/bin/python" --verifytypes osmosis_ai --ignoreexternal: verified the current installed wheel; no unexpected errors after applying the documented harbor.harness_agent exception (two baseline diagnostics).
• Fresh non-editable environment outside the checkout, installed with uv sync --locked --all-extras --no-dev --no-editable: the existing verify-wheel-install.py --scenario full passed with 152 runtime distributions.
• Rechecked the current GitHub alerts against the final lockfile: all 11 affected-version ranges are excluded.

CI remains responsible for the supported Python matrix and individual-extra wheel installation scenarios.

Checklist

• PR title follows [module] type: description format (labels are derived from it automatically — no need to add them by hand)
• ruff check . and ruff format --check . pass
• ty check --error-on-warning osmosis_ai/ passes; uv run --no-editable pyright --verifytypes osmosis_ai --ignoreexternal has no unexpected errors (see CONTRIBUTING.md for the Harbor baseline)
• pytest passes (new tests added if applicable)
• Public API changes are documented (no public API changes)
• No secrets or credentials included