chore(deps): bump raes from 3.0.0 to 3.3.0

[dependabot]

Plain-language summary

• Context: LilRAE consumes released RAES APIs, and Dependabot updates the exact dependency from 3.0.0 to 3.3.0.
• Problem: The generated dependency and lock update cannot pass while repository policy and its tests still require RAES 3.0.0.
• Fix: Align pyproject metadata, the lock, repository policy, package-identity assertions, and policy fixtures on the exact released dependency raes==3.3.0.

Issues closed

Closes #28

Verification

• UV_PYTHON=3.11 make verify: 60 passed; hygiene, policy, project services, Ruff, mypy, coverage, clean sdist-to-wheel build, isolated install, import, and CLI smoke passed.
• Direct CPython 3.12 policy, project-services, Ruff, mypy, and pytest lane: 60 passed.
• Authoritative Ubuntu CI passed Verify (Python 3.11), Verify (Python 3.12), both PR metadata gates, CodeQL, GitGuardian, and Sonar.
• The installed-wheel smoke remains intentionally Python 3.11 in this dependency PR; ci: run installed-wheel smoke under the matrix interpreter #29 tracks the separate matrix-interpreter packaging correction.
• RAES release comparison: OpenRAE/rae@v3.0.0...v3.3.0

[doublewhy]

Stack order: #30 is the packaging-only successor to this PR and currently targets this Dependabot feature branch. Merge #24 first; then retarget #30 to dev, update it from the merged base, and rerun every required check. Auto-merge is disabled.