build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

README.md

@@ -24,9 +24,8 @@ This repository keeps GNU GPL v3 licensing for compatibility with that upstream
 Project dependencies (from `pyproject.toml`):
 
 - `PySide6`
-- `opencv-python`
+- `opencv-python-headless`
 - `numpy`
-- `Pillow`
 
 ## Quick Start