Avoid shell=True in dependency conflict check script

[bsbodden]

Summary

scripts/check_deps.py invokes curl through subprocess.run(..., shell=True) when checking PyPI package metadata.

Current behavior

The script builds a shell command string for each dependency and executes it via the shell:

subprocess.run(
    f"curl -s https://pypi.org/pypi/{pkg}/{ver}/json",
    shell=True,
    capture_output=True,
    text=True,
)

The same file also has an unsorted import block, which causes ruff check . to fail.

Why this matters

Using shell=True is unnecessary for this case and can be flagged by security tooling. It also makes the script more dependent on shell behavior and the presence of curl on the host system.

Suggested resolution

Replace the shell invocation with urllib.request, requests, or a list-form subprocess call without shell=True. Sort the imports so ruff check . passes.