fix(deps): bump datasets past PYSEC-2026-3716 (#3136)

## Why this is urgent

`datasets` 4.5.0 picked up **PYSEC-2026-3716** — path traversal in
folder-based dataset builders, where an unvalidated `file_name` metadata
field is joined to the dataset directory, so crafted traversal sequences
can read arbitrary local files into output on
`save_to_disk`/`push_to_hub`.

**The advisory was published today between 07:17 and 15:35 UTC.**
`main`'s audit passed at 07:17 on `17522fb0`; every PR run after 15:35
fails. So `Dependency audit (pip-audit)` is now **red repo-wide and
blocks all open PRs**, not just one.

## Exposure

Negligible for us. `datasets` is confined to the `evals` and
`voice-train` extras, and every call site in the repo uses
`load_dataset` against public Hub datasets — we never build folder-based
datasets from untrusted metadata, and never call
`save_to_disk`/`push_to_hub` on them.

But the gate audits the `[all]` production set and fails on any
actionable finding, so it has to be resolved rather than waived.

## The change

Bump both extras to `>=5.0.1` and relock. `load_dataset` — the only API
this repo touches — is unchanged across 2.x → 5.x.

Lock diff is **5 lines, `datasets` alone**; nothing else re-resolved.

## Verification

Ran the workflow's own command locally (`uv export --frozen --no-dev
--no-emit-project --no-hashes --extra all`, audited under Python 3.12 to
match CI):

```
No known vulnerabilities found
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Tejas Chopra <tejas@Tejass-MacBook-Pro.local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

pyproject.toml

@@ -246,12 +246,12 @@ voice = [
 # Voice training (includes voice deps + training extras)
 voice-train = [
     "headroom-ai[voice]",
-    "datasets>=2.14.0",
+    "datasets>=5.0.1",
     "accelerate>=0.20.0",
 ]
 # Evaluation framework
 evals = [
-    "datasets>=2.14.0",
+    "datasets>=5.0.1",
     "sentence-transformers>=2.2.0,<6.0; sys_platform != 'darwin' or platform_machine != 'x86_64'",
     "numpy>=1.24.0",
     "scikit-learn>=1.3.0",