Fix: pin urllib3 to <2.0.0 for verify jobs