fix(release): address 0.43.0 RC feedback

[jernejfrank]

Summary

Address the non-blocking follow-ups reported while verifying 0.43.0 RC1:

• install the Graphviz Python package through the tests extra
• derive the official build epoch from the anchored Git HEAD timestamp
• recover and propagate that same epoch from source and sdist archive members for voter/CI rebuilds
• retain byte-for-byte SHA-512 verification of rebuilt sdists
• update the tracking UI transitive nanoid dependency from 3.3.16 to 3.3.18
• make UI CI use a clean lockfile install and non-mutating ESLint/Prettier checks
• fix the existing UI formatting findings and enforce zero lint warnings

Validation

• release/verifier/Graphviz tests — 39 passed
• Python 3.9 syntax check
• full isolated release plus voter rebuild — rebuilt sdist SHA-512 and wheel contents matched
• extracted-sdist wheel build without .git — passed
• clean npm ci
• npm audit — zero vulnerabilities
• npm run build
• npx vitest run — 1 passed
• npm run lint
• npm run format
• LICENSE-wheel covers all 130 bundled npm packages
• focused pre-commit hooks — passed

[elijahbenizzy]

Merged main into this branch so it's mergeable again (conflicted with #899). Kept #899's tempdir sdist build and layered the git-anchored SOURCE_DATE_EPOCH env on top of it. Only other edit: retargeted the monkeypatch in the #899 test from _source_date_epoch to _git_source_date_epoch, since this PR removes the former. Tests, pre-commit, and the stricter UI lint/format gate all pass locally. Will approve once CI is green.

[elijahbenizzy]

Reviewed the conflict resolution against #899 and re-ran tests, pre-commit, and the UI lint/format gate locally. LGTM.