bump deps

[adhami3310]

Rust deps

• pyo3 0.28 → 0.29 (0.29.2). No source changes needed — #[pymodule(gil_used = false)], Bound, and the #[pyo3(signature = ...)] attr all compile unchanged.
• ruff git rev 9b03f2b2 → fbe3e251 (ruff_python_formatter / ruff_python_parser, crate versions 0.0.1 → 0.0.8).
• cargo update on the rest of the tree. Notable: zip 0.6.6 → 8.6.0, wasm-bindgen 0.2.118 → 0.2.127, thiserror 2.0.18 → 2.0.20, zerocopy 0.8.48 → 0.8.56. The lock shrinks a fair bit (dropped wit-bindgen/wasm-* and serde_with).

CI

Re-pinned to the latest release SHAs:

• actions/checkout v6.0.2 → v7.0.1
• actions/setup-python v6.2.0 → v7.0.0
• actions/attest v4.1.0 → v4.2.2
• astral-sh/setup-uv v8.1.0 → v9.0.0
• download-artifact v8.0.1, upload-artifact v7.0.1 and maturin-action v1.51.0 were already current.

Two checks on the major bumps: setup-python v7 drops the pip-install input (unused here) and its "remove EOL Python versions" change only touched their own test workflows, so python-version: "3.8" still resolves. setup-uv v9 flips prune-cache to false by default — a cache-size change, not a behavior break.

I also regenerated the workflow from the maturin template to check for drift. maturin 1.14.1 emits a byte-identical template to 1.13.3 for this project, and our file already matches it apart from two deliberate local customizations, both preserved: the SHA pins (vs the template's floating @v6/@v1 tags) and the omitted UV_PUBLISH_TOKEN env (we use PyPI trusted publishing via id-token: write). So the only change here is the header comment, now v1.14.1.

Version: 0.5.2 → 0.5.4

Skipping 0.5.3 deliberately. The v0.5.3 tag already exists on c6823b0, but that release never made it to PyPI — latest there is 0.5.2. Cargo.toml wasn't bumped in that commit, so the tagged build produced another 0.5.2 and PyPI would have rejected it as a duplicate. Reusing 0.5.3 now would collide with the existing tag, so 0.5.4 is the next clean number. Patch bump matches the precedent from #4, the previous deps bump.

Test plan

• cargo build clean on pyo3 0.29 + the new ruff rev.
• maturin develop + smoke test: format_string, the line_width= kwarg, and is_valid_syntax all behave correctly.