fix(lint): unblock develop's lint pipeline

Two pre-existing lint reds on develop, caused by toolchain drift since
the last green run (2026-01-29). Develop's source is otherwise byte-
identical to the last passing commit.

- pipenv-verify: regenerate Pipfile.lock under current pipenv. The lock
  was produced by an older pipenv whose Pipfile-hashing differs from
  what `pipenv verify` computes today, even though Pipfile is unchanged.
  Lock now matches `pipenv verify` cleanly. Dependency versions are
  bumped to current point releases as a side effect.
- mypy: widen `QDataStreamProtocol.pack_block` to accept `bytes |
  bytearray`. Newer mypy releases (pulled via the unpinned
  jpetrucciani/mypy-check@master action) no longer accept passing a
  `bytearray` to a `bytes` parameter, and `pack_message` builds its
  argument as a `bytearray`. Cast back to `bytes` at return so the
  declared return type still holds for both inputs.

`pipenv verify`, `mypy server/ main.py`, and `tests/unit_tests/test_protocol.py`
are clean locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Brutus5000