Update dev/CI dependencies to the HA 2026.6.3 test stack

[cognitivegears]

Summary

Processes the open dependabot backlog in one PR (repo precedent: #113). End users' minimum HA version is unchanged at 2026.5.0 — every runtime requirement change stays inside the existing manifest.json ranges.

• Test harness: pytest-homeassistant-custom-component 0.13.333 → 0.13.339 (HA 2026.5.4 → 2026.6.3). Dev-only; supersedes Bump pytest-homeassistant-custom-component from 0.13.348 to 0.13.349 in the ha-test-harness group across 1 directory #94.
• Dev pins follow HA 2026.6.3's package_constraints.txt: serialx 1.7.3 → 1.8.0 (sync API unchanged; manifest keeps >=1.7.0,<2), dbus-fast 4.0.4 → 5.0.16 (manifest keeps >=3.1.2,<6).
• wcwidth 0.8.1 → 0.8.2 (runtime, unconstrained by HA on any version; IndexError bugfix). Supersedes Bump wcwidth from 0.8.1 to 0.8.2 #119.
• ruff 0.15.18 → 0.15.22; mypy stays 2.1.0 because mypy 2.2+ needs ast-serialize>=0.6 while harness 0.13.339 hard-pins ast-serialize==0.3.0 (unresolvable). mypy added to the dependabot ignore list with the same pattern as pytest/respx. Partially supersedes Bump the ruff-toolchain group across 1 directory with 2 updates #121.
• uv lock --upgrade picks up pip 26.1.2 (Bump pip from 26.1.1 to 26.1.2 #120) and msgpack 1.2.1 (Bump msgpack from 1.1.2 to 1.2.1 #110) among transitives.
• security.yml pip-audit ignore list rebuilt — this fixes the security-scan job that has been red on main: Pillow 12.2.0 advisories (PYSEC-2026-2253…2257, 3451…3453) are fixed only in 12.3.0, which no HA release ships yet. Stale ignores (old Pillow/aiohttp/PyJWT/requests/pytest/uv entries) removed; current HA-2026.6.3-pinned advisories (Pillow, aiohttp 3.13.5, cryptography 48.0.0, PyJWT 2.12.1) added with comments.
• README requirements corrected: minimum HA is 2026.5 (was stale at "2026.3"; the floor was raised to 2026.5.0 when serial support landed, since SerialPortSelector doesn't exist earlier).

Verification (local, on this branch)

• uv run pytest — 944 passed
• uv run ruff check . — clean
• uv run mypy custom_components/ — clean
• uv run pip-audit with the new ignore list — clean
• scripts/check_requirements_sync.py — manifest and pyproject in sync

Note: ruff format under the pre-commit-pinned v0.15.13 wants to reformat 35 files on main (pre-existing drift, not caused by this PR); left out deliberately to keep this diff dependency-only.

🤖 Generated with Claude Code