build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

packaging/appimage/build-appimage.sh

@@ -26,7 +26,6 @@ uv export \
   --frozen \
   --no-dev \
   --no-emit-project \
-  --no-hashes \
   --format requirements-txt \
   --output-file "${BUILD_DIR}/requirements.txt"
 uv build --wheel --out-dir "${BUILD_DIR}"
@@ -36,11 +35,11 @@ if [[ -z "${WHEEL_PATH}" ]]; then
     echo "Could not find built wheel in ${BUILD_DIR}" >&2
     exit 1
 fi
-printf "%s\n" "${WHEEL_PATH}" >> "${BUILD_DIR}/requirements.txt"
 
 export SCANSLICER_ROOT="${ROOT_DIR}"
 export SCANSLICER_APPDIR="${APPDIR}"
 export SCANSLICER_REQUIREMENTS="${BUILD_DIR}/requirements.txt"
+export SCANSLICER_WHEEL="${WHEEL_PATH}"
 
 cd "${BUILD_DIR}"
 "${APPIMAGE_BUILDER_BIN}" --recipe "${ROOT_DIR}/packaging/appimage/AppImageBuilder.yml"