chore(deps): drop unused safety dev dep (removes unfixable nltk HIGH)

`safety` was declared in the dev group but never invoked — the CI
security-scan job only runs bandit and pip-audit, and pip-audit already
provides the same dependency-CVE scanning. Its only practical effect was
pulling in nltk, which carries an unpatched HIGH path-traversal advisory
(GHSA-p4gq-832x-fm9v) with no fix available.

Removing safety drops nltk (and safety-schemas/typer/tenacity/tomlkit)
from the lockfile entirely, closing the alert with no loss of coverage.
Updated the stale CI comment that referenced safety. Full suite green
(2537 passed); pip-audit and bandit unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -79,9 +79,9 @@ jobs:
           uv run --frozen graphify install
 
   security-scan:
-    # The dev deps already include bandit, pip-audit, and safety. Run them in
-    # CI so a new HIGH-severity finding or vulnerable dependency is caught on
-    # the PR that introduces it, rather than at the next manual audit.
+    # The dev deps include bandit and pip-audit. Run them in CI so a new
+    # HIGH-severity finding or vulnerable dependency is caught on the PR that
+    # introduces it, rather than at the next manual audit.
     # Non-blocking for now (continue-on-error) to avoid breaking CI on
     # pre-existing findings; remove continue-on-error after the initial
     # cleanup pass.