fix(deps): the hvac cap the comment described was never in the specifier

[wshallwshall]

Two lines of specifier, zero lock churn. Found during the Dependabot audit in #121; split out because
it touches uv.lock and that PR deliberately touches no lock.

The defect

pyproject.toml declared the Vault extra as hvac>=2.3.0, directly under a comment reading:

Floor >=2.3.0: the current 2.x line (Python 3.8+, requests-based); a bare >= would silently jump a
major on re-lock, so keep the floor pinned to the 2.x series.

A bare >= is exactly what hvac>=2.3.0 is. The 2.x hold was documented and unenforced — prose acting
as a compensating control on a false premise, which is the specific failure mode
Secure_Development_Standards §3 warns about.

Why it is worth fixing rather than just rewording

hvac fronts the store DEK — ADR 0019 §3, Vault Transit envelope decryption. And CI never installs
the [vault] extra, so nothing in the matrix would exercise an hvac 3.x arriving through a routine
re-lock. It would reach a release unexercised.

Rewording the comment instead was the alternative and I rejected it: any rewording that said "a major
is adjudicated by CI on its own Dependabot PR" would itself be false, for the same
extra-never-installed reason.

The change

hvac>=2.3.0 → hvac>=2.3.0,<3, and the comment now describes what the specifier does.

Zero resolution impact. hvac stays at 2.4.0, so uv lock rewrites exactly one specifier line and
nothing else moves.

Verification

Run with the CI-pinned uv==0.12.0, because a different resolver version can re-export differently
and red the DEP-1 byte-diff for an unrelated reason:

• Baseline first: re-exported all six locks against unmodified main → byte-identical, so any diff
  below is attributable to this change and not to local drift.
• After the change: uv lock → 1 line in uv.lock. All six exports re-run → byte-identical
  (requirements.lock, constraints.lock, docker/locks/requirements-{core,sqlserver}.lock,
  ci/locks/ci-{scanners,quality}.lock). git diff --exit-code over the six is clean, so DEP-1 passes
  with no churn.
• uv lock --check (the drift guard) passes.
• 139 tests covering packaging, dependency-declaration, install-provenance, venv pinning, the Vault
  key provider and the crypto inventory scanner: all pass.

Deliberately not done

No Dependabot ignore entry to match this cap — unlike the annotated-types / ruff caps in #121.
Those exist because Dependabot kept widening them and reddening CI. Here, auto-merge already routes
majors to manual review, so the cap is not load-bearing against automation; adding an ignore would
suppress hvac's security track for no gain. If a future Dependabot PR is seen widening this cap, that
judgement should be revisited.

🤖 Generated with Claude Code