build: harden dependency supply chain

- Drop unused Pillow dependency
- Switch opencv-python to opencv-python-headless (~=4.13.0)
- Verify package hashes in the AppImage build (uv export hashes,
  pip install --require-hashes, separate --no-deps wheel install)
- Sync dependency docs and third-party notices

pyproject.toml

@@ -20,8 +20,7 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "Pillow",
-  "opencv-python",
+  "opencv-python-headless~=4.13.0",
   "numpy",
   "PySide6",
 ]