[eschaar]

Summary

• Consolidate the dependency updates proposed in chore(deps): bump virtualenv from 21.7.13 to 21.14.13 #118, chore(deps): bump the pip-patch-minor group across 1 directory with 2 updates #119 and chore(ci): bump the gha-patch-minor group across 1 directory with 4 updates #120.
• Update virtualenv to 21.14.13, packaging to 26.3, Ruff to 0.17.1 and tox to 4.67.1.
• Update setup-python to 7.1.0, PyPI publish to 1.14.3, create-github-app-token to 3.3.0 and TruffleHog to 3.99.7; preserve full commit SHA pins.
• Validate the Homebrew token Action identity and full SHA pin without hardcoding one dependency revision.

Why

• Replace three overlapping dependency PRs with one tested change. PR chore(deps): bump types-pyyaml from 6.0.12.20260815 to 6.0.12.20260906 #109 was already incorporated into main and has been closed separately.
• Prevent legitimate Action updates from failing a version-specific workflow assertion.
• Verified locally: make check; 793 tests per Python 3.11–3.15 with 100% coverage in every environment; formatting, Markdown lint, Ruff and mypy pass. Poetry lock validation and vstack validate/verify pass.
• Keep chore(deps): bump virtualenv from 21.7.13 to 21.14.13 #118, chore(deps): bump the pip-patch-minor group across 1 directory with 2 updates #119 and chore(ci): bump the gha-patch-minor group across 1 directory with 4 updates #120 open until this replacement is merged. No production behavior or public API changes.

Version impact

• None
• Patch
• Minor
• Major