fix(deps): bump pillow to 12.3.0 and setuptools to 83.0.0

[KedoKudo]

Problem

The Dependency check step (pixi run audit-deps → pip-audit --local -s osv) gates the Unit tests job and was failing on fresh OSV database entries, turning green PRs red with no code change. Most recently it blocked the pre-commit autoupdate PR #185:

• pillow 12.2.0 → PYSEC-2026-2255 / 2256 / 2257 (fixed in 12.3.0)
• setuptools 82.0.1 → PYSEC-2026-3447 (fixed in 83.0.0) — appeared in OSV after [pre-commit.ci] pre-commit autoupdate #185's run

Fix

Both are installable conda-forge builds, so this relocks to the patched versions (the real remedy) rather than ignoring the findings:

• pillow is a direct, security-pinned dependency → floor bumped >=12.2.0 → >=12.3.0, matching the repo's CVE-annotated floor convention.
• setuptools is a transitive build tool → cleared by the lock refresh.

Diff is surgical: only pillow and setuptools change in pixi.lock; no workflow changes.

Verification

$ pixi run audit-deps
No known vulnerabilities found

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 2.29%. Comparing base (0aeb7d1) to head (d558e5e).

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #186   +/-   ##
=====================================
  Coverage   2.29%   2.29%           
=====================================
  Files          4       4           
  Lines        131     131           
=====================================
  Hits           3       3           
  Misses       128     128           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.