test(labeling): pin max_concurrency=1 so batch-order assertion is deterministic

The assertion recorded the order batches reached their LLM call inside worker
threads, which is nondeterministic; the product merges by cid on the main
thread and concurrency equivalence is covered by a sibling test. Takes only the
flaky-test fix from #3374 (its SECURITY.md/uv.lock changes are handled
separately).

tests/test_labeling.py

@@ -275,7 +275,11 @@ def test_label_communities_batches_when_over_batch_size(monkeypatch):
         return "{" + ", ".join(f'"{c}": "Cluster {c}"' for c in cids) + "}"
 
     monkeypatch.setattr("graphify.llm._call_llm", fake_call)
-    labels = label_communities(G, communities, backend="gemini", batch_size=100)
+    # max_concurrency=1 keeps the batches sequential so `calls` records them in a
+    # deterministic order; the default concurrent path can complete them out of
+    # order (the ordering is asserted separately in
+    # test_label_communities_parallel_matches_sequential).
+    labels = label_communities(G, communities, backend="gemini", batch_size=100, max_concurrency=1)
 
     # 250 communities / 100 per batch -> 3 batches (100, 100, 50)
     assert calls == [100, 100, 50]