chore(deps): bump vulnerable dev-only tooling (#160)

Lock bumps for GitPython (via tach), tornado (via ipykernel),
virtualenv (via pre-commit), setuptools (via pyinstaller) and
datamodel-code-generator. datamodel-code-generator 0.61+ blocks
private-network URLs by default, so the dev codegen target passes
--allow-private-network.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ehe9991

scripts/generate_service_types.py

@@ -76,6 +76,8 @@ def main() -> int:
         "ruff-format",
         "ruff-check",
     ]
+    if url == ENV_URLS["dev"]:
+        cmd.append("--allow-private-network")
     result = subprocess.run(cmd)
     return result.returncode