bump deps and release 0.2.2

[adhami3310]

Routine dependency bump, plus a patch version bump to 0.2.2.

Rust

• pyo3 0.28.3 → 0.29.2 (major for a 0.x crate). Despite the heavy FFI usage in src/lib.rs and src/pydict.rs, no source changes were required — cargo check and cargo clippy are clean with no warnings.
• Transitive via cargo update: libc 0.2.185 → 0.2.189, portable-atomic 1.13.1 → 1.15.0, proc-macro2 1.0.106 → 1.0.107, quote 1.0.45 → 1.0.47, syn 2.0.117 → 2.0.119.

Python

• pytest-codspeed 4.4.0 → 5.0.3 (major), pytest 9.0.3 → 9.1.1, py-spy 0.4.1 → 0.4.2. Floors in [dependency-groups] raised to match.
• Transitive: markdown-it-py 4.0.0 → 4.2.0, packaging 26.1 → 26.3. cffi and pycparser drop out — codspeed 5.x no longer needs them.

CI

Bumped the four SHA-pinned actions that were behind:

Action	From	To
actions/checkout	v6.0.2	v7.0.1
actions/setup-python	v6.2.0	v7.0.0
astral-sh/setup-uv	v8.1.0	v9.0.0
actions/attest	v4.1.0	v4.2.2

maturin-action (v1.51.0), upload-artifact (v7.0.1) and download-artifact (v8.0.1) were already current. Each SHA was resolved via both the releases API and git ls-remote on the tag refs; all refs remain SHA-pinned with a version comment.

The three major bumps were checked against this workflow specifically and none of the breaking changes apply:

• checkout v7 restricts fork checkout for pull_request_target/workflow_run — this workflow only uses push/pull_request/workflow_dispatch.
• setup-python v7 removes the pip-install input — not used here.
• setup-uv v9 changes prune-cache to default false — the release job uses it bare to run uv publish, so no meaningful cache impact.

The maturin template header moved to v1.14.1, but that is a comment-only change: the v1.14.1 stock template output is byte-identical to v1.13.3's. The file was not regenerated, which would have dropped the SHA pins and reintroduced the UV_PUBLISH_TOKEN env block on the publish step — Trusted Publishing via id-token: write is preserved.

Verification

uv sync builds the extension and reports 0.2.2; 194/194 tests pass locally. The CI action bumps are runner-side and can only be validated by this PR's own run — setup-python@v7 on the windows-11-arm runner with architecture: arm64 is the combination worth watching.

Note: merging does not publish. The release job triggers on tag push, so cutting v0.2.2 is still a separate step.