build(deps): bump nltk 3.10.0 -> 3.10.3 in uv.lock (Dependabot critical + high)

GHSA-m4rf-3fr8-xwx3 (JVM argument injection via per-call options in the
Stanford wrappers, incomplete fix of CVE-2026-12841) and GHSA-6hwm-xvph-95vm
(uncontrolled search path when invoking the Graphviz dot binary). nltk is a
transitive dependency of llama-index-core; `uv lock --upgrade-package nltk`
changes three lines, `uv lock --check` passes, and the cloud/postgres export
that backs requirements-docker.lock is byte-identical, so that file is
untouched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J3GWtYaCZMgwXLBjDpED9N

Author: JuliaEdom

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### Security — nltk 3.10.0 -> 3.10.3 in uv.lock (Dependabot GHSA-m4rf-3fr8-xwx3, GHSA-6hwm-xvph-95vm)
+
+- `uv lock --upgrade-package nltk` only; nltk is a transitive dependency of `llama-index-core` and is not part of the `cloud`/`postgres` export, so `requirements-docker.lock` is unchanged. Closes the critical (JVM argument injection in the Stanford wrappers) and high (uncontrolled `dot` search path) advisories GitHub reported on the default branch on 2026-09-01.
+
 ### Security — production boot requires a query-fingerprint pepper (AF-13)
 
 `QueryAnalyticsPolicy.from_env` now fails closed on `AGENTFLOW_PROFILE=production`