fix: update vulnerable Reachy dependencies

[johnnygreco]

Summary

• update reachy-mini from 1.8.0 to the stable 1.10.0 remediation
• update the macOS GStreamer bundle and all resolved components from 1.28.6 to the security-fixed 1.28.7 release
• require Python 3.11+ for Reachy Mini 1.10 and reconcile its Pydantic minimum with Gradio through the existing uv override mechanism
• follow Data Designer's precedent: keep LGPL denied globally while permitting only the reviewed GStreamer package/source/version/reported-license tuple
• fail closed on exception drift or stale exceptions, with targeted policy and CLI tests

Validation

• uv lock --check
• uv run ruff check .
• Python 3.11: uv run pytest -q (267 passed)
• Python 3.12: uv run pytest -q (267 passed)
• dependency-license tests: 49 passed
• committed-revision dependency-license audit: 2 enforced, 0 failures
• Dev Notes renderer: 11 passed
• documentation validation: 25 passed, 3 skipped
• scripts/build-docs.sh
• application and Reachy daemon CLI help smoke checks
• offline OpenAI Realtime backend configuration check
• pip-audit: no known vulnerabilities

uv run ty check remains nonzero due existing diagnostics on main (31 on main, 24 on this branch); the dependency update introduces no new type diagnostics.

[github-actions]

Documentation preview

The preview has been removed.