chore(deps): refresh uv.lock after the google-cloud-pubsub exclude-newer exemption

pyproject.toml declares `google-cloud-pubsub` in [tool.uv.exclude-newer-package]
(the quarantined ==2.39.0 pin), but uv.lock's [options.exclude-newer-package]
block never picked the entry up.

uv >= 0.12 treats an exemption pyproject declares and the lock does not record
as lockfile drift, so `uv sync --locked` rejects the committed lock:

    $ ~/.hermes/bin/uv lock --check        # uv 0.12.9, the version the installer drops in $HERMES_HOME/bin
    error: The lockfile at `uv.lock` needs to be updated, but `--check` was provided.
    $ /tmp/uv-0.9.28/uv lock --check       # the version the uv.lock CI check pins
    rc=0

That makes the SQLite runtime repair (managed_uv._stage_candidate_venv, which
builds the replacement venv with `uv sync --extra all --locked`) fail on every
affected install: `hermes update` ends at "partially complete — SQLite … still
has the WAL-reset corruption bug" and never repairs the runtime. CI is blind to
it because every workflow pins uv 0.9.28.

Regenerated with uv 0.12.9; the diff is metadata only (the missing exemption
plus the block's key ordering) — no package version changes, and the
regenerated lock still passes `uv lock --check` under 0.9.28.

uv.lock

@@ -52,8 +52,8 @@ ruamel-yaml = false
 sherpa-onnx = false
 huggingface-hub = false
 pytest-asyncio = false
+google-cloud-pubsub = false
 slack-sdk = false
-unpaddedbase64 = false
 discord-py = false
 honcho-ai = false
 faster-whisper = false
@@ -62,8 +62,9 @@ debugpy = false
 packaging = false
 rich = false
 supermemory = false
-youtube-transcript-api = false
+unpaddedbase64 = false
 h2 = false
+youtube-transcript-api = false
 edge-tts = false
 microsoft-teams-apps = false
 aiohttp-socks = false