Fix dependency vulnerabilities

[vavo]

Summary

Fixes currently reproducible dependency vulnerabilities in the worker dependency manifests:

• updates the RunPod SDK requirement to the 1.9 line
• pins cryptography==46.0.7, which contains fixes for the currently reported cryptography CVEs
• makes the Docker image install runtime Python dependencies from requirements.txt, so the manifest fix is actually used by the image build
• updates @changesets/cli and the lockfile so picomatch resolves to patched 2.3.2

Validation

• pnpm audit --json
• pip-audit -r requirements.txt
• pnpm install --frozen-lockfile
• bash -n src/*.sh scripts/*.sh
• python3 -m json.tool package.json
• python3 -m json.tool test_input.json
• python3 -m compileall handler.py src
• docker buildx bake --print base