chore(deps): drop diskcache from crewai via instructor 1.15.3

[dcbouius]

Addresses the crewai diskcache finding (CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v — pickle-deserialization RCE, no fixed diskcache version exists).

The fix isn't a version bump of diskcache (there is none) — it's removing the dependency. instructor 1.12.0 hard-depended on diskcache; 1.13+ moved it behind an optional diskcache extra, so upgrading drops it from the resolution.

• instructor 1.12.0 → 1.15.3
• diskcache 5.6.3 removed from hindsight-integrations/crewai/uv.lock

uv lock --check passes.

Note on the other diskcache finding (root uv.lock)

The root lock's diskcache comes from llama-cpp-python (optional local-llm extra), and llama-cpp-python 0.3.30 (latest) still hard-requires diskcache>=5.6.1 — so it can't be dropped the same way. Mitigating factors:

• Not in the default install, not in the [all] extra (local-ml,local-onnx,embedded-db), and not in the shipped Docker images (--extra local-ml --extra embedded-db). It's in uv.lock only because uv locks every extra.
• The CVE requires an attacker to have write access to the cache directory; it's explicitly not exploitable for a single-process app with an isolated cache.

That one is a candidate for a Vanta risk-acceptance (or dropping the local-llm extra), since no upstream remediation exists.