bump main pyo3 and gate stub generation

[lucarlig]

🚦 Summary

Area	Change
🟢 Runtime PyO3	Bumps the main workspace PyO3 stack to 0.29 released crates.
🟡 Stub tooling	Keeps pyo3-stub-gen on the released crate and gates it behind the non-default stub-gen feature.
🔴 Security exception	Adds a two-week cargo deny advisory exception for the PyO3 0.28 RustSec advisories, expiring 2026-06-29.
🔵 Release path	Keeps normal build, install, and release workflows from invoking stub generation while upstream compatibility is blocked.

🎯 Why

pyo3-stub-gen 0.22.3 does not currently compile against pyo3 0.29.

This PR keeps the production/runtime plugin graph on PyO3 0.29 while isolating stub generation as explicit tooling. The temporary advisory exception is time-boxed so we do not silently carry the vulnerable PyO3 0.28 path.

🧭 Behavior

Command/path	Result
✅ Default workspace build	Uses PyO3 0.29 and does not compile pyo3-stub-gen.
✅ PyPI wheel build	Does not include or link pyo3-stub-gen.
✅ Release preflight	Verifies checked-in .pyi files exist.
⚠️ --features stub-gen / --all-features	Still blocked by upstream pyo3-stub-gen compatibility.

🧪 Validation

• ✅ cargo fmt --all
• ✅ cargo check --workspace --all-targets
• ✅ cargo deny check --config deny.toml
• ✅ make plugins-validate
• ✅ python3 -m unittest tests/test_plugin_catalog.py
• ✅ cargo test --workspace

⚠️ Known Limitation

cargo check --workspace --all-targets --all-features still fails inside pyo3-stub-gen 0.22.3 against PyO3 0.29. That is the compatibility blocker this PR quarantines until upstream ships a compatible release.

[gandhipratik203]

This solves the current issue. The runtime path is on PyO3 0.29, stub generation is isolated from normal build/release flows, and CI is green. Good to go from my side.