[cdbartholomew]

Routine dependency maintenance for hindsight-system-evals/uv.lock.

Closes Dependabot alerts #1959 #1960 #1961

• aiohttp 3.14.3 → 3.14.5 (GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-5wr8-gcqf-gqf3)
• hindsight-client 0.10.2 → 1.0.0 (local project: the lock now matches the version already declared in its pyproject.toml)
• yarl 1.24.5 → 1.25.1 (required by the newer aiohttp)

The lock was regenerated with uv lock --upgrade-package for aiohttp only; nothing else was re-resolved apart from what those upgrades require.

Verification

• uv build: OK
• uv sync --frozen: OK
• uv run pytest tests: 25 passed, 1 skipped in 7.22s

No CI job currently exercises this directory, so the local run above is the verification for this change.

[cdbartholomew]

Merging on local verification rather than CI coverage. No CI job or path filter covers this directory, so none of the checks on this PR exercises the lockfile changed here.

Verification was run in a clean worktree of this branch (cut from main) during this run:

• uv build: OK
• uv sync --frozen: OK
• uv run pytest tests: 25 passed, 1 skipped in 7.22s

There were no failures, so there was nothing to compare against main. The test run imports the package and its framework dependencies, so every import evaluated at load time resolved against the new versions.