Ensure all dependencies have a lower bound

The problem

If you set up with uv, anything without a lower bound causes things to break

Definition of "done"

• check that everything we add to pyproject.toml has a lower bound or is pinned

Additional context