chore(deps): fold all open dependabot updates and take the newest PDF parser

[us]

Folds every open dependabot PR into one branch and takes the newest published
release of the PDF parser.

Supersedes #415, #396, #382, #381, #284.

What changed

Rust (Cargo.lock, 16 crates) — tokio 1.52.3→1.53.1, serde_json 1.0.150→1.0.151,
toml 1.1.3→1.1.4, lol_html 3.0.0→3.0.1, htmd 0.5.4→0.5.5, xxhash-rust 0.8.16→0.8.18,
regex 1.13.0→1.13.1, pdf-inspector 0.1.4→0.1.6, similar 3.1.1→3.1.2,
schemars 1.2.1→1.2.2, thiserror 2.0.18→2.0.20, clap 4.6.1→4.6.6, uuid 1.23.5→1.24.0,
libc 0.2.186→0.2.189, async-trait 0.1.89→0.1.91, anyhow 1.0.103→1.0.104.

The lockfile is taken verbatim from the current dependabot group PR, so it does not
go stale the moment this merges.

GitHub Actions (9) — checkout 7.0.0→7.0.1, setup-uv 8.3.2→9.0.0, claude-code-action
1.0.174→1.0.183, codeql-action 4.37.0→4.37.4, setup-python 6.3.0→7.0.0,
docker/login-action 4.4.0→4.6.0, scorecard-action 2.4.3→2.4.4.

setup-uv v9 flipped prune-cache from true to false. Pinned back to true at all five
call sites so the uv cache keeps getting trimmed instead of competing with the Rust
caches for the repo's cache budget. setup-python v7 dropped the pip-install input,
which the one call site (release.yml publish-pypi) never used.

TypeScript SDK — typescript 6.0.3→7.0.2, @types/node→26.2.0. TS 7 removed
moduleResolution: node10, which the CJS build used; bundler is the only mode it
still pairs with module: CommonJS. Emit verified byte-identical to the tsc 6 output
for dist/esm (including .d.ts) and dist/cjs, so the published package is unchanged.

bench — aiohttp 3.14.1→3.14.3.

PDF parser

pdf-inspector is Firecrawl's own parser (github.com/firecrawl/pdf-inspector).
0.1.7 is the newest release on crates.io, but it is not the one this PR takes.

A/B'd process_pdf_mem over 30 real PDFs (arXiv papers plus the repo fixture),
total markdown extracted:

version	chars over the corpus	vs 0.1.6
0.1.4 (what main ships)	1,902,036	-23,148
0.1.6 (this PR)	1,925,184	—
0.1.7 (newest)	1,911,452	-13,732

0.1.7 is a small improvement on 7 documents and roughly equal on 21, but on
arXiv 1412.6980 it drops pages 6-11 to 4-39% of their text, losing the
experiments section and the whole bibliography. Pages either side are
byte-identical and 0.1.5/0.1.6 extract the document fully, so it is a
regression, not a quality tradeoff. Upstream main behaves the same way.

So the workspace pins =0.1.6 and dependabot ignores 0.1.7 specifically,
which still leaves 0.1.8 to be offered when it lands. Reported upstream.

lopdf stays on 0.41 because pdf-inspector still pins ^0.41.0. The
dependabot ignore entry for it is still correct; its comment was refreshed to
say why and when it can be dropped.

Verification

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings clean.
• cargo build --workspace --all-targets ok, cargo test --workspace 1590 passed.
• SDK: npm ci && npm run build && npm test 17/17, emit byte-identical to tsc 6.
• htmd 0.5.4 vs 0.5.5 over 15 real pages: 14 byte-identical, 1 gains 418 chars, zero
  words lost anywhere.
• lol_html 3.0.1's fixes (uppercase attribute selectors, :nth-of-type casing) are
  unreachable here; neither construct appears in clean.rs or table_normalize.rs.
• similar 3.1.2 fixes Algorithm::Lcs deadline panics; crw-diff uses only
  TextDiff::from_lines with the default algorithm and no deadline, so that path is
  not reached.
• bench/requirements.txt resolves cleanly with uv.
• Every bumped action SHA verified against its version tag.