Update dependency virtualenv to v21.14.5

[renovate]

Virtualenv 21.14.5 adds a packaging dependency and supports filelock 4. This updates the complete hash-verified pre-commit tool graph, adds packaging 26.3, upgrades filelock to 4.0.10, and aligns Renovate's filelock bound with virtualenv's <5 requirement. All eleven pins match current compatible PyPI releases.

The test image removes the unused Python 3.9 pip/setuptools seed archives while preserving the exact upstream Python 3.14 pip 26.2.1 and setuptools 84.0.0 wheel bytes and SHA-256 verification. A fresh pre-commit Python hook environment confirms environment creation and package installation still work. These tools stay out of production Privateerr. 🏴‍☠️

The scan review reports the full remaining findings: all three test-image platforms have 2 Trivy findings and 24 Scout identifiers. Twelve Scout identifiers concern retained packages or metadata; twelve concern removed Python 3.9 assets in virtualenv's original upstream package SBOM, which is preserved. Six CVEs in current pip's vendored dependencies await an upstream pip release containing fixes. No scanner exclusions, customized pip distribution, or provenance rewriting are introduced.

Validation: full strict test suite (38 Python tests), production and test builds for amd64/arm64/armv7, both vulnerability scanners on all test-image platforms, fresh Python hook environment, all normal pre-commit hooks, CSpell across 131 files, and strict documentation build passed. Independent review confirmed retained wheel hashes, removed-file absence, and reported scan counts.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[scottgigawatt]

Reviewed the complete compatible hashed tool graph, active Python 3.14 seed preservation, fresh Python hook creation, and full three-platform scans. The remaining findings and upstream SBOM inventory are documented accurately; no scanner findings are suppressed. All local validation passed, and merge remains gated on the final exact-head CI result.