👷 ci: pin ubuntu-26.04, clear warnings, bump deps

[gaborbernat]

GitHub starts moving ubuntu-latest to Ubuntu 26.04 on October 19 and plans to finish by November 19 (actions/runner-images#14748). Until it finishes, every job on that label gets a migration notice annotation. 🐧 Pinning those jobs to ubuntu-26.04 moves them to the new image on our schedule and drops the notice. Jobs already pinned to ubuntu-24.04 stay as they are.

The embedded-dependency upgrade job ran setup-uv before checkout, so it found an empty workspace and no files to key its cache on, and warned about both. Checkout runs first now. The job sits behind a harden-runner egress allowlist that excludes the cache service, so the step also sets enable-cache: false.

The 🔎 test custom queries job warned that codeql-action could not reach its API endpoints and named the missing security-events: read permission, which the job now grants.

The pytest diagnostics upload warned on every run that produced no hang diagnostics. An empty upload is the normal outcome of a clean run, so it uses if-no-files-found: ignore.

ruff's new context-manager-iterator rule asks for Generator instead of Iterator on @contextmanager functions; the annotations follow the Generator[X, None, None] form the code base already uses.

📦 While touching the workflows I bumped the GitHub Actions pins, pre-commit hooks and Python dependency floors to their latest releases, one commit per kind.

The newer hooks reformatted a few files; those changes sit in their own commit.