Update Pillow dependency policy

[soodoku]

What changed

• require Pillow 12.3.0 and update only Pillow's lockfile record
• document the repository's manual dependency-review policy
• record the change under Unreleased

Why

The default branch used Pillow 12.2.0, which GitHub flags through Dependabot. Research releases remain fixed by their tags and lockfiles, while security patches on main are reviewed manually. Automated Dependabot update pull requests are disabled; vulnerability alerts remain enabled.

Validation

• uv lock --check
• uv sync --locked --dev installs Pillow 12.3.0
• make ci: 45 tests pass; formatting and lint pass
• make paper: derived analysis only; no collection or frame extraction rerun
• all four analysis_data.parquet files are byte-identical to version 0.1.0
• forced 28-page LaTeX compile succeeds and ms/ms.pdf is byte-identical to version 0.1.0
• visual inspection confirms figures, maps, and tables are not clipped