fix(security): upgrade pyo3 and numpy to 0.28, fix RUSTSEC-2025-0020

Bumps the Python binding from pyo3 0.22 / numpy 0.22 to 0.28 / 0.28,
which resolves RUSTSEC-2025-0020 — a buffer overflow in
`PyString::from_object` that affected every published Python wheel.

Migration:

- `into_pyarray_bound(py)` → `into_pyarray(py)` (numpy 0.23 dropped the
  `_bound` transitional suffix; the method now returns `Bound<'py, _>`
  directly).
- `downcast::<PyDict>` → `cast::<PyDict>` (pyo3 renamed the method on
  `PyAnyMethods`).
- Every `#[pyclass]` declares `skip_from_py_object` to opt out of the
  now-deprecated automatic `FromPyObject` derive for `Clone` types.
  Indicators are stateful — silently extracting them by value-clone is
  never the intended FFI semantics.
- Workspace clippy gains `unused_self = "allow"` on the python crate
  only: Python's `__repr__` protocol forces `&self` even for parameter-
  less indicators where the body does not read state.
- `map_err` arms collapsed into a single `PyValueError` arm
  (clippy::match_same_arms).

`deny.toml` no longer suppresses RUSTSEC-2025-0020; `cargo deny check`
is green on advisories, bans, licenses and sources without exceptions.

deny.toml

@@ -9,15 +9,6 @@ all-features = true
 # Fail on any security advisory or unmaintained/unsound crate in the tree.
 version = 2
 yanked = "deny"
-ignore = [
-    # RUSTSEC-2025-0020 — PyString::from_object buffer overflow in pyo3 0.22.
-    # Reached only through the python binding (numpy 0.22 -> pyo3 0.22). The
-    # fix requires upgrading pyo3 to >=0.24.1, which also forces a numpy
-    # upgrade and a Bound-API migration of bindings/python — a separate,
-    # tracked piece of work. The published Rust crates and the Node/WASM
-    # bindings do not depend on pyo3.
-    { id = "RUSTSEC-2025-0020", reason = "pyo3 0.22 upgrade tracked separately; affects only bindings/python" },
-]
 
 [bans]
 # Catch accidental duplicate versions and wildcard ("*") version requirements.