fix(deps): bump Pygments to >=2.20.0 for CVE-2026-4539

[sergioestebance]

Summary

• Add uv constraint to pin Pygments to >=2.20.0 to fix CVE-2026-4539 (ReDoS via inefficient regex for GUID matching)

Production impact

Very low. Pygments is a transitive dependency via rich, used for syntax highlighting. The ReDoS requires crafted GUID-like input to trigger.

Fixes #251

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.

The PR changes runtime dependency constraints and the lockfile to bump the transitive package Pygments from 2.19.1 to 2.20.0. Dependency/version changes affect production behaviour and are not limited to the allowed low-risk categories (docs/UI/test config), so this should not be auto-labeled low-risk without a normal review.

This PR requires a manual review before merging.

[sergioestebance]

Closing as duplicate of #478, which has been rebased and is conflict-free.