Fix native Dependabot uv updates

[YKDZ]

Summary

• declare spaCy tooling compatibility across the Python 3.12 minor while keeping the deployed patch pinned to 3.12.11
• regenerate the uv lockfile with its canonical Python 3.12 compatibility marker
• let native Dependabot manage the spaCy Dockerfile in addition to its uv manifest
• protect the Python deployment/compatibility and ecosystem ownership contracts with a tooling test

Root cause

Dependabot's uv updater currently runs Python 3.12.13. The project metadata claimed compatibility with only 3.12.11, so every proposed uv update failed before resolution even though CAT intentionally deploys 3.12.11. The package compatibility declaration and deployment pin were conflated.

Validation

• uv lock --offline
• pnpm exec vitest run scripts/ci-config-contract.spec.ts (17/17)
• pnpm check (178/178)