Refresh Graphify and Highlight.js dependencies

[bifrost0x]

Summary

• update Graphify from 0.9.39 to 0.9.42 and regenerate the hash-locked graph requirements
• update Highlight.js assets from 11.11.2 to 11.12.0 and refresh the committed vendor bundle
• fix the privileged Dependabot vendor workflow so it checks out the validated PR head before generation and verifies trusted helper-script checksums before execution
• apply available Debian security updates in both container stages so the current pinned base image no longer ships the fixable util-linux CVE-2026-53615

This consolidates the dependency changes from #112 and #113.

Verification

• scripts/lock_requirements.ps1 -Check
• pytest tests -q - 1,587 passed, 33 skipped
• focused dependency and supply-chain policy tests - 62 passed
• npm run vendor:check
• npm run lint:js
• npm run test:js - 200 passed
• npm run test:e2e - 65 passed, one unrelated one-off failure; the failed case passed on an isolated rerun
• git diff --check

Container build and multi-architecture Trivy results are left to the pull request workflows because the local Docker engine is unavailable.