[Thomas A Caswell (tacaswell)]

Update locked packages and GitHub Actions to versions fixed for the emSign CA incident.

• Require Pixi >= 0.82.1
  Pixi 0.82.1 is the release fixed for the emSign CA incident.
  • pixi.toml: requires-pixi None -> '>=0.82.1' (added)
• Update ca-certificates, certifi, pip in pixi.lock
  Update the locked packages to versions fixed for the emSign CA incident.
  Raise the floors in pixi.toml:
  • dependencies.pip: '>=25.2,<26' -> '>=26.2.2' (dropped the upper bound <26, which excluded the fixed version)
    Output of pixi update --manifest-path pixi.toml ca-certificates certifi pip:
    (output omitted here to keep the description short; it is in the commit message)
• Update GitHub Actions for the emSign CA incident
  • .github/workflows/ci.yaml:33: prefix-dev/setup-pixi pixi-version v0.74.0 -> v0.83.0
  • .github/workflows/ci.yaml:54: prefix-dev/setup-pixi pixi-version v0.74.0 -> v0.83.0
  • .github/workflows/docs.yml:38: prefix-dev/setup-pixi pixi-version v0.74.0 -> v0.83.0

[Copilot]

🟢 Approval recommended

The manifest requirements, lockfile updates, and workflow pins are consistent, with no blocking issues identified.

No open issues 🎉

What changed in this PR

This PR updates PowderLine’s dependency environment and CI tooling to address the emSign CA incident without changing application code.

Changes:

• Requires Pixi ≥0.82.1 and pip ≥26.2.2.
• Refreshes locked certificate packages and pip across both environments and all supported platforms.
• Updates test and documentation workflows to Pixi v0.83.0.

File	Description
pixi.toml	Sets minimum patched Pixi and pip versions.
pixi.lock	Updates certificate packages, pip, and associated lock metadata.
.github/​workflows/​docs.yml	Uses Pixi v0.83.0 for documentation deployment.
.github/​workflows/​ci.yaml	Uses Pixi v0.83.0 for tests and documentation validation.

_{Review effort: Balanced}