surya-ocr pins pillow<11 — the last pillow-10.4.0 fork in the lock hangs on one upstream bound

[LetsGetToWorkBro]

What happened

After #651, uv.lock carries exactly one pillow 10.4.0 fork, and its resolution markers show it belongs to doc-ocr alone:

$ curl -s https://pypi.org/pypi/surya-ocr/json | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print(d['info']['version'], [x for x in d['info']['requires_dist'] if 'illow' in x])"
0.22.1 ['pillow<11,>=10.2.0']

pillow 10.4.0 carries the full advisory backlog (heap OOB writes in paste/crop/ImageCms, decompression bombs, font parser bugs — see decisions/0013); every fix lands in 12.1.1–12.3.0. The three doc-ocr pairs in [tool.uv] conflicts also exist only because of this bound.

Ask

Easiest-first, same shape as #612's birdnetlib story:

1. Upstream it. A PR to datalab-to/surya widening the pillow bound fixes this for everyone. Read decisions/0012 first — the last time a pin here looked "almost certainly incidental" it was load-bearing and relaxing it alone would have shipped a TypeError. Prove surya's image path works on pillow 11/12 (run their test suite against it), don't assume.
2. Check whether a newer surya already did it. They release fast; if a release lifts the bound, our side is a relock plus removing the three doc-ocr conflict pairs.
3. Argue it doesn't matter and close this. doc-ocr ships in no profile and the pillow surface there is the wearer's own documents, not hostile input. If that's your position, say so and it gets folded into decisions/.

Verifying a fix

cd host-python
# bump/verify the surya-ocr bound, remove the three doc-ocr pairs from [tool.uv] conflicts
uv lock && uv lock --check
python3 -c "import tomllib; print({p['version'] for p in tomllib.load(open('uv.lock','rb'))['package'] if p['name']=='pillow'})"
# the 10.4.0 fork should be gone
python -m pytest src/dreamlayer/tests/test_lockfile.py -q

Where

host-python/pyproject.toml (doc-ocr extra, [tool.uv] conflicts), decisions/0013 (pillow section)