ci: add reproducible supply-chain gates

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=77.0", "wheel"]
+requires = ["setuptools==80.9.0", "wheel==0.45.1"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -46,11 +46,18 @@ dependencies = [
 dev = [
     "build==1.2.2.post1",
     "mypy==1.13.0",
-    "pytest==8.3.4",
-    "pytest-cov==6.0.0",
-    "ruff==0.8.6",
+    "pytest==9.1.1",
+    "pytest-cov==7.1.0",
+    "ruff==0.16.2",
+]
+spaces = ["gradio>=6.7,<7.0"]
+
+[dependency-groups]
+ci = [
+    "build==1.2.2.post1",
+    "pip-licenses==5.5.5",
+    "twine==7.0.0",
 ]
-spaces = ["gradio>=5.0,<6.0"]
 
 [project.scripts]
 obliteratus = "obliteratus.cli:main"
@@ -98,4 +105,15 @@ markers = [
 ]
 
 [tool.uv]
+constraint-dependencies = ["pillow>=12.2.0"]
 exclude-newer = "3 days"
+
+[tool.uv.sources]
+torch = [
+    { index = "pytorch-cpu", marker = "sys_platform == 'linux' or sys_platform == 'win32'" },
+]
+
+[[tool.uv.index]]
+name = "pytorch-cpu"
+url = "https://download.pytorch.org/whl/cpu"
+explicit = true