security: refresh vulnerable release build dependencies

[codeforester]

Summary

• refresh the hash-locked release toolchain to current secure versions
• refresh the PEP 517 backend pins used by isolated builds to the same versions
• add an explicit urllib3 pin so the release path cannot resolve the vulnerable transitive line
• update the release-process documentation to match the lock workflow

Closes #447.

Validation

• pip-audit -r requirements/release.txt: no known vulnerabilities
• clean isolated build of sdist and wheel with setuptools 84.0.0 and wheel 0.48.0
• validate_package_artifact.py: passed
• twine check: passed
• git diff --check: passed