fix: pin NLTK path security fixes

[muscariello]

Summary

• Pin the transitive NLTK dependency to upstream commit c06cd2645e3116156466bece11a9eb989c04afae, which contains the pathsec fixes for GHSA-8mgp-746c-j5xp / CVE-2026-81726.
• Keep the lockfile reproducible until NLTK publishes a patched release.

Validation

• uv lock --check passed.
• Verified the installed NLTK source is the pinned commit and that TransitionParser and AveragedPerceptron model paths use pathsec guards.
• pip-audit reports no findings other than the advisory being addressed by the unreleased upstream source fix.
• NoA web-surfer import smoke test passed.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!