build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

packaging/appimage/AppImageBuilder.yml

@@ -90,7 +90,8 @@ AppDir:
     test -f "${APPDIR_PATH}/.DirIcon"
     rm -rf "${APPDIR_PATH}/usr/lib/x86_64-linux-gnu/qt6"
     rm -f "${APPDIR_PATH}"/usr/lib/x86_64-linux-gnu/libQt6*.so*
-    python3 -m pip install --no-cache-dir --upgrade --ignore-installed --prefix=/usr --root="${APPDIR_PATH}" -r "${SCANSLICER_REQUIREMENTS}"
+    python3 -m pip install --no-cache-dir --require-hashes --ignore-installed --prefix=/usr --root="${APPDIR_PATH}" -r "${SCANSLICER_REQUIREMENTS}"
+    python3 -m pip install --no-cache-dir --no-deps --ignore-installed --prefix=/usr --root="${APPDIR_PATH}" "${SCANSLICER_WHEEL}"
 
 AppImage:
   arch: x86_64

packaging/appimage/build-appimage.sh

@@ -26,7 +26,6 @@ uv export \
   --frozen \
   --no-dev \
   --no-emit-project \
-  --no-hashes \
   --format requirements-txt \
   --output-file "${BUILD_DIR}/requirements.txt"
 uv build --wheel --out-dir "${BUILD_DIR}"
@@ -36,11 +35,11 @@ if [[ -z "${WHEEL_PATH}" ]]; then
     echo "Could not find built wheel in ${BUILD_DIR}" >&2
     exit 1
 fi
-printf "%s\n" "${WHEEL_PATH}" >> "${BUILD_DIR}/requirements.txt"
 
 export SCANSLICER_ROOT="${ROOT_DIR}"
 export SCANSLICER_APPDIR="${APPDIR}"
 export SCANSLICER_REQUIREMENTS="${BUILD_DIR}/requirements.txt"
+export SCANSLICER_WHEEL="${WHEEL_PATH}"
 
 cd "${BUILD_DIR}"
 "${APPIMAGE_BUILDER_BIN}" --recipe "${ROOT_DIR}/packaging/appimage/AppImageBuilder.yml"