fix(reachy): update vulnerable Transformers dependency

[johnnygreco]

Summary

• raise both Reachy local-vision extras to transformers>=5.17,<6, the scanner-recommended fixed release
• regenerate uv.lock, updating Transformers to 5.17.0 and its Tokenizers dependency to 0.23.2
• assess the exporter golang.org/x/crypto finding against the compiled import graph and the Go vulnerability database

Go finding assessment

The CSV provides no fixed release for golang.org/x/crypto. The applicable module-level advisory is GO-2026-5932 for the unmaintained golang.org/x/crypto/openpgp package. The exporter does not import openpgp; its compiled dependency graph uses chacha20poly1305, cryptobyte, and hkdf. govulncheck -show verbose ./... reports that the exporter is affected by 0 vulnerabilities, with GO-2026-5932 present only at module level and not in imported packages or symbols. No Go dependency change is necessary.

Validation

• uv lock --check
• ruff check .
• python -m compileall src tests
• pytest -q tests/vision/test_processors.py (30 passed)
• govulncheck -show verbose ./... (0 reachable vulnerabilities)
• go mod verify
• go vet ./...
• go test -race ./...
• go build ./cmd/...

The full Reachy uv run pytest -q and uv run ty check workflows require the project-supported macOS environment; this Linux host cannot sync the Darwin-only lock environment. The directly affected vision suite, lock validation, lint, and compilation checks pass.