Refresh lockfile for security patches, fix mypy 2.x/stale config, fix publish trigger

[chrishayuk]

Summary

• `uv lock --upgrade` closes the remaining Dependabot alerts not covered by the merged Renovate PRs: starlette 1.3.1 (SSRF/host-header/form-limit issues), idna 3.18 (ReDoS).
• That upgrade pulled in mypy 2.3.0, which surfaced two issues unrelated to the security work:
  • `mypy.ini` pinned `python_version = 3.9`, which mypy 2.x refuses to target (minimum 3.10) and which was already stale — `pyproject.toml` requires `>=3.11`. Corrected to 3.11.
  • With the correct target, mypy now understands 3.11's exception-group syntax and caught a real type mismatch: `_is_benign_shutdown_exc` was typed to take `Exception` but is called with items pulled from `BaseExceptionGroup.exceptions`, which can be any `BaseException`. The function body only calls `str(exc)`, so widening the parameter to `BaseException` is correct, not just a suppression.
  • `mcp_pydantic_base.py`: a dynamic constructor call narrows `Any` to `type[object]` once guarded by `hasattr(expected, 'bases')`, losing sight of the real class being called. Scoped `type: ignore[call-arg]` with explanation, matching the existing pattern in this file for structurally similar dynamic dispatch.
• `publish.yml` only triggered on `release: published`, but GitHub Actions blocks `GITHUB_TOKEN`-authored events (which is what `Create Release` uses) from triggering other workflows, so it never actually fired on tag releases. Added a direct `push: tags: v*..` trigger plus a tag/pyproject.toml version guard, matching the other chuk-* repos. The `pypi` GitHub Environment already existed here, so no changes needed there.

Test plan

• `uv run pytest tests/` — 1276 passed, 6 skipped
• `uv run ruff check .` / `ruff format --check .` — clean
• `uv run mypy src --ignore-missing-imports` — clean on mypy 2.3.0 (real latest)
• CI green on this PR