Land the pending dependency bumps as signed commits

This carries the four pending Renovate bumps as our own signed commits: gitlab-dev-stack 1.8.1, just 1.59.0, uv 0.13.1 and the debian bookworm-slim digest. The just and uv bumps include their new sha256 pins, which Renovate cannot supply.

It supersedes !84 (closed), !83 (merged), !82 (closed) and !38, whose commits are unsigned and fail the commit-trailers check because Renovate has not re-run since the sign-off fix in !88 (merged). dev-stack 1.8.1 passed a live just lab validate on main plus this change. Renovate closes its MRs once each dependency is current.