Refresh the CI dependency pools to the current releases - #631

Stacked on #630. One commit remains here, the sparse pool refresh: the general pool refresh described first below landed on main as part of #629.

Refresh the CI dependency pools to the current releases. The pools had drifted a few releases behind: numpy 2.5, scipy 1.18, numba 0.65 through 0.67, and awkward 2.12 and 2.13 all exist and none were reachable except through the "latest" draw, which does not pin and so never produces a reproducible combination. Each addition brings a constraint, read off the packages' own conda metadata rather than assumed:

• numpy 2.5 and scipy 1.18 have no py3.11 builds.
• numba declares an exclusive numpy ceiling. 0.64 through 0.66 stop below 2.5, so numpy 2.5 forces numba 0.67 or latest.
• scipy below 1.16 stops below numpy 2.5. The comment above that block already said so; only the numpy <2.3 half was implemented.

awkward needs nothing new: the existing numpy 2.5 rule already re-picks from the pool filtered to >=2.10, so 2.12 and 2.13 join it for free. Each rule is added to both apply_constraints and validate. The stress test covers 160000 combinations and passes; deleting any one of the three new fix-ups makes it fail (760, 3329 and 50380 bad combinations respectively), which is what says they are load-bearing rather than decorative.

Refresh the sparse pool and lift its stale Python 3.13 exclusion. The refresh above left sparse behind: the pool stopped at 0.15 while 0.16 through 0.19.2 exist, and py3.13/3.14 hardcoded "NA" under a comment saying sparse does not support them. That was true in the 0.15 era, when numba could not run on those Pythons; it is not true now. Every sparse release here is noarch with numba >=0.49 and no numpy ceiling, so only the Python floors matter: 0.16/0.17 declare python >=3.10 and 0.18/0.19 declare >=3.11. On py3.13/3.14 the pool starts at 0.16 because 0.14/0.15 predate those Pythons. No new pairing rules are needed: the workflow already skips sparse whenever numba is skipped or NA. Verified beyond metadata on py3.14 (macOS arm64): sparse 0.16.0 and 0.19.2 pass the pydata-sparse io tests, and 0.18.0 passed the full suite. Stress test: 160000 combos, 0 failures.