build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

THIRD_PARTY_NOTICES

@@ -23,9 +23,7 @@ Python packages bundled by the AppImage build:
 - numpy 2.4.2 (Python 3.11+) or 2.2.6 (Python < 3.11)
   License metadata (installed Python 3.11 build): BSD-3-Clause AND 0BSD AND
   MIT AND Zlib AND CC0-1.0
-- Pillow 12.1.1
-  License metadata: MIT-CMU
-- opencv-python 4.13.0.92
+- opencv-python-headless 4.13.0.92
   This package is installed from PyPI according to `uv.lock`. Consult the
   package's bundled metadata and license files in the installed wheel for the
   exact terms that apply to the shipped build.