fix(deps): floor anyio at >=4.14.2 for CVE-2026-63374 / CVE-2026-64847

[IngmarVG-IB]

Why

anyio 4.12.1 in uv.lock is affected by CVE-2026-63374 and CVE-2026-64847, both fixed in 4.14.2.

Dependency Audit is a required status check under the main-protection ruleset, and that ruleset has strict_required_status_checks_policy: true — so branches must be up to date with main to merge. The net effect today: the audit fails on main's own lock, so every open PR fails a required check as soon as it syncs. #266 already shows this (approved, up to date, audit red). The other open PRs only show Dependency Audit = SUCCESS because they are BEHIND and last ran against an older main.

This PR fixes it at the root so the unblock doesn't depend on reviewing any larger change.

What

• Add anyio>=4.14.2 to the core dependencies, with the CVE reference, following the existing floor-comment convention (pyjwt, python-multipart, urllib3, pygments).
• Re-resolve the lock with uv lock --upgrade-package anyio → anyio 4.15.1.

Why core dependencies and not the mcp extra

httpx is a core dependency and pulls anyio (uv.lock also shows mcp, starlette and sse-starlette depending on it). A plain pip install dns-aid is therefore in the affected tree. Putting the floor behind [mcp] would leave the base install resolvable to a vulnerable anyio.

Incidental, both intended

• typing-extensions 4.15.0 → 4.16.0 — anyio 4.15.1 widens that marker to python_full_version < '3.15'.
• uv.lock's requires-dist recorded mcp>=1.28.1,<2.0.0 while pyproject.toml already declared <3.0.0. That pre-existing lock/manifest drift self-corrects on re-resolve. No ceiling was changed by hand.

Verification

Ran the exact invocation from .github/workflows/security.yml, same five documented --ignore-vuln suppressions:

$ uv run --with pip-audit pip-audit --ignore-vuln CVE-2025-8869 ... --ignore-vuln CVE-2026-3219
No known vulnerabilities found

Full unit suite, compared in clean /tmp worktrees to isolate local config:

	result
main	6 failed, 2837 passed, 49 skipped
this branch	6 failed, 2837 passed, 49 skipped

Identical — no regressions. The 6 pre-existing failures are all Akamai/.edgerc tests that pick up a real ~/.edgerc on my machine; they pass on CI runners, which have none.

Also green locally: ruff check (clean), mypy src/dns_aid (87 files, no issues). ruff format --check flags 3 files under examples/, unchanged here and identically flagged on main.

Suggested merge order

Landing this first turns Dependency Audit green repo-wide, after which the remaining PRs only need a sync + review: #266 (already approved) → #262 → #265 → #269 → #270.

Note #268 also carries an anyio>=4.14.2 floor, but scoped to the [mcp] extra. If this lands first, that hunk can drop from #268 and it stays focused on the bearer-auth normalization; if #268 lands first, the base-install path is still uncovered and this floor should move to core.

[nicknacnic]

Clean fix. All CI green, dep-audit flips from red to green repo-wide. Floor belongs in core deps (not the mcp extra) for the reason stated — httpx pulls anyio into the base install. Lock re-resolve looks correct; incidental typing-extensions bump and mcp ceiling drift are expected and benign. Good suggested merge order in the description. Approving.