fix(deps): bump certifi and virtualenv to clear pip-audit advisories (#232)

The Quality Gate pip-audit step fails on every PR because of three new
advisories against packages pinned in uv.lock:

- certifi 2026.2.25 -> 2026.10.19 (PYSEC-2026-4320, revoked emSign root)
- virtualenv 21.14.2 -> 21.14.12 (CVE-2026-113725, CVE-2026-113726)
- distlib 0.4.0 -> 0.4.4 (moved with virtualenv, which requires >=0.4.3)

Generated with `uv lock --upgrade-package certifi --upgrade-package virtualenv`.

Fixes #231


Claude-Session: https://claude.ai/code/session_013fePq8hgqbtNvf2pNvA3WC

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: tmatup