chore(ci): refresh Spark py3.14 pins for security advisories

[lmeyerov]

Release-readiness finding

GitHub reports four open Dependabot alerts against requirements/spark-py3.14.in:

• pyarrow==22.0.0: GHSA-rgxp-2hwp-jwgg / CVE-2026-25087, patched in 23.0.1. The advisory explicitly says the affected pre-buffering API is not exposed in Python bindings, so this is not a pygraphistry runtime exploit, but the lock still triggers a high alert.
• setuptools==80.9.0: GHSA-h35f-9h28-mq5c / CVE-2026-59890, patched in 83.0.0. This is a macOS sdist exclusion-normalization issue.
• pytest==9.0.1: GHSA-6w46-j5rx-g56g / CVE-2025-71176, patched in 9.0.3. This is test-runner-only local temporary-directory handling.
• requests==2.32.5: GHSA-gc5v-m9x4-r6x2 / CVE-2026-25645, patched in 2.33.0. Standard Requests usage is not affected; the vulnerable utility is extract_zipped_paths().

0.59.0 assessment

This does not block the 0.59.0 package release:

• the manifest is the direct-input lock for the focused Spark CI lane, not a package lock shipped to users;
• setup.py does not cap these runtime dependencies below their patched versions, so fresh package installs can resolve patched releases;
• the publish workflow builds in an isolated environment rather than from this Spark lock;
• the sole high advisory excludes Python bindings.

The stale pins should still be removed so CI exercises supported patched versions and the repository returns to a clean Dependabot state.

Acceptance criteria

• Confirm Spark/Python 3.14 compatibility for pyarrow >=23.0.1, setuptools >=83.0.0, pytest >=9.0.3, and requests >=2.33.0.
• Update requirements/spark-py3.14.in and regenerate the hashed lock with PROFILES=spark VERSIONS=3.14 ./bin/generate-lockfiles.sh.
• Run the focused Spark lane and lockfile checks.
• Verify Dependabot alerts 2–5 close, or document/dismiss any alert that remains a proven ecosystem false positive.