fix(deps): require Pillow 12.3.0

[paul-cch]

Summary

• Raise the supported Pillow floor from 12.2.0 to 12.3.0.
• Correct the Unreleased security note and link the five advisory records fixed by the new floor.

Why

Pillow 12.2.0 is affected by five advisories published after the earlier dependency update. Pillow 12.3.0 fixes them and remains compatible with WalBridge's Python 3.11 requirement.

Authoritative references:

• https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html
• https://osv.dev/vulnerability/PYSEC-2026-2253
• https://osv.dev/vulnerability/PYSEC-2026-2254
• https://osv.dev/vulnerability/PYSEC-2026-2255
• https://osv.dev/vulnerability/PYSEC-2026-2256
• https://osv.dev/vulnerability/PYSEC-2026-2257

Validation

• Fresh Python 3.11 resolution installed Pillow 12.3.0 and PyObjC 12.2.1; pip check passed.
• Exact OSV queries returned five records for Pillow 12.2.0 and none for 12.3.0.
• Ruff passed.
• All 73 unit tests and all 8 CLI flow tests passed.
• Bash syntax, ShellCheck, workflow YAML, Quartz import, and display detection passed.
• Both Swift tools compiled and passed runtime smoke tests.
• The sandboxed installer compiled and deployed all expected files with launchd intercepted.
• Autoreview returned no accepted or actionable findings.
• Privacy and Public Model Identifier Gates: PASS.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[paul-cch]

Landed proof for the Pillow 12.3.0 prerequisite:

• Reviewed commit: 03bcbcc6a86ec78de9814fb65a7ba00fff840b0c
• Merge commit: a9933af76741dacdb9a1b5772cf7ba94687bf66d
• Pull-request CI: https://github.com/paul-cch/WalBridge/actions/runs/29437905049
• Exact-head main CI: https://github.com/paul-cch/WalBridge/actions/runs/29438079149
• Fresh Python 3.11 resolution installed Pillow 12.3.0 and PyObjC 12.2.1; pip check passed.
• Exact OSV queries returned five records for Pillow 12.2.0 and none for 12.3.0.
• Local proof passed Ruff, 73 unit tests, 8 CLI flow tests, Bash syntax, ShellCheck, workflow YAML, Quartz/display checks, both Swift builds and runtime smokes, and the sandboxed installer.
• GitHub Actions passed all seven jobs, including macOS validation and installer smoke.
• Autoreview returned no accepted or actionable findings.
• Privacy and Public Model Identifier Gates: PASS.