fix(tools/security-tracker-stats-dashboard): align Python floor to 3.11

[Shaurya2k06]

Summary

• Align requires-python, ruff target-version, and mypy python_version in tools/security-tracker-stats-dashboard to the repo-wide 3.11 floor (they previously disagreed: 3.9 / py39 / 3.10).
• Update the README Runtime prerequisite to Python 3.11+ and refresh the tool uv.lock header.
• Apply the py311 ruff fixes the raised target now surfaces (datetime.UTC / zip(..., strict=True)).
• Re-lock root uv.lock mypy requires-dev specifiers to >=2.3.0 so prek stops rewriting the lock when this tool's README is touched (same correction as build(deps-dev): re-lock uv.lock against the mypy>=2.3.0 dev pins #965 — drop that hunk if build(deps-dev): re-lock uv.lock against the mypy>=2.3.0 dev pins #965 lands first).

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek commit hooks pass on the changed files
• uv run --directory tools/security-tracker-stats-dashboard --group dev pytest — 114 passed
• uv run --directory tools/security-tracker-stats-dashboard --group dev ruff check / mypy — clean
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
• For skill behaviour changes: a new or updated eval fixture is included in this PR
• Other:

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — placeholders used in skill / tool prose (N/A for this version-floor change)
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Closes #948

Notes for reviewers (optional)

If #965 merges first, rebase and drop the root uv.lock hunk — it is only included so prek's vendor-neutrality hook does not fail this branch on README touch.

[justinmclean]

Right alignment: this was the last tool on >=3.9 while root and the other 29 are >=3.11, and nothing in CI pins a Python version.

For anyone wondering why a version bump carries datetime.UTC and zip(..., strict=True): both ruff rules are silent at py39 and fire at py311, so they're what keeps ruff check green once target-version moves. datetime.UTC is the same object as datetime.timezone.utc, a pure rename. strict=True is the real choice, since strict=False would preserve the old truncating behaviour.