deps: relock to latest, vgi-rpc 0.40.0 -> 0.42.1

Also pyarrow 25.0.0 -> 25.0.1, httpx2 2.9.1 -> 2.10.0, librt 0.13.0 ->
0.15.0, platformdirs, numpy, sqlglot, sentry-sdk, ruff, coverage.

vgi-rpc 0.42.1 raises the served wire protocol to 1.3.0, so workers now
require a VGI client that speaks 1.3.0 — haybarn 1.5.5rc1's community
`vgi` extension is the first build that does. This matches the existing
haybarn>=1.5.5rc1 floor on the [haybarn] extra.

Only uv.lock is committed here; the rest of the working tree is
unrelated in-progress work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rustyconover