[P2][security] triar as 4 vulns do Dependabot na default-branch (1 high / 2 moderate / 1 low)

[FabioLeitao]

Repo PÚBLICO → Dependabot reporta 4 vulns na default-branch (1 high / 2 moderate / 1 low). A high merece olhar primeiro.

AC: triar cada alerta (Security → Dependabot) — fixável via bump? VEX/allowlist justificado? abrir PR de bump pras acionáveis. Liga #765 (gitleaks-action/Node24, blocked-upstream).

[FabioLeitao]

Triage 2026-06-30 (session autonomous):

Severity	Package	Status
high	py7zr arbitrary file write	Fixed on main via #1097 (py7zr>=1.1.3)
moderate	py7zr DoS / zip bomb (×2)	Partially addressed by 1.1.3; verify GH alert closure after next default-branch scan
low	torch torch.jit.script	Deferred — optional ML extra; #975 open Dependabot PR needs isolated validation (large bump 2.10→2.12)

Next: close/supersede Dependabot #974; land #915 hatchling + dep-review #1011 in chore PR; hold #1025 bulk uv ×31 and #1029 docker 3.14 until deliberate slice.