fix: refresh cryptography security locks

[AdeGneus]

Summary

• pin the SDK runtime constraint to cryptography 49.0.0
• regenerate both hash-locked requirement files so CI installs the fixed release

Root cause

The dependency input accepted cryptography <50, but both CI lockfiles still pinned cryptography 48.0.1. CI therefore continued installing and auditing the stale vulnerable pin after the Dependabot constraint update.

Validation

• 455 tests passed via uv
• python3 scripts/check_workflows.py
• git diff --check

[AdeGneus]

CI diagnosis: pip-audit flagged cryptography 49.0.0 as PYSEC-2026-3552; the advisory fix is 50.0.0. Updated both lockfiles and project constraints to cryptography>=50.0.0,<51 in commit 17c00df. Local validation: 455 tests passed and supply-chain guard passed.