build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

docs/appimage.md

@@ -28,15 +28,15 @@ bash packaging/appimage/build-appimage.sh
 
 What the script does:
 
-1. Exports runtime requirements from `uv.lock` to `appimage/build/requirements.txt`
+1. Exports runtime requirements (with hashes) from `uv.lock` to `appimage/build/requirements.txt`
 2. Builds wheel into `appimage/build/`
-3. Appends wheel path to requirements list
-4. Sets:
+3. Sets:
   - `SCANSLICER_ROOT`
   - `SCANSLICER_APPDIR`
   - `SCANSLICER_REQUIREMENTS`
-5. Runs `appimage-builder` with `AppImageBuilder.yml`
-6. Moves `.AppImage` and `.zsync` artifacts to `appimage/dist/`
+  - `SCANSLICER_WHEEL`
+4. Runs `appimage-builder` with `AppImageBuilder.yml`
+5. Moves `.AppImage` and `.zsync` artifacts to `appimage/dist/`
 
 ## Dockerized Build
 
@@ -71,7 +71,7 @@ Optional environment variables:
 - Uses Ubuntu Noble apt sources
 - Bundles Python and runtime shared libs
 - Removes bundled Qt system libs to prefer PySide wheel Qt runtime
-- Installs Python dependencies and project wheel into AppDir `/usr`
+- Installs Python dependencies (hash-verified) and project wheel into AppDir `/usr`
 - Injects desktop entry and icon assets during `after_bundle`
 - Copies `LICENSE` and `THIRD_PARTY_NOTICES` into `usr/share/doc/scanslicer/`