#1063 highway-dsl generator (vm-1 dsl-generator.service): clear provenance findings brotli, certifi, werkzeug, setuptools

EARS SPEC: - The dsl-generator venv (highway_dsl/app/.venv-uv313) shall contain no package version with an open OSV finding from infra #156 phase 5 (brotli 1.2.0, certifi 2026.7.22, werkzeug 3.1.8, setuptools 84.0.0). - Where a flagged package is not imported by the app or by any installed package that the app uses, the venv shall not contain it. - When the venv changes, dsl-generator.service shall be restarted and /health, /api/v1/dsl-context and / shall return the same status and body as before the change. SYNTHESIS: dependency hygiene; remove unused optional deps (brotli is an optional httpx/urllib3 decoder, Required-by none; setuptools only required by zope.interface, which nothing imports and nothing requires) and upgrade the two in-use ones (certifi via requests/httpx, werkzeug via Flask). Alternative VEX rejected: infra says upgrading is the default.