Sweep dependencies, pin uv in CI, and bump to 2.9.1

[vvillait88]

Summary

Dependency sweep for python-commerce, plus the release bump to 2.9.1.

• agentscore-py floor >=2.6.9 to >=2.6.10, the release published earlier in this sweep, so merchants installing 2.9.1 get it.
• uv lock --upgrade: uvicorn 0.52.4 to 0.53.0, pyjwt 2.13.0 to 2.14.0, httpx2/httpcore2 2.12.0 to 2.13.0, multidict 6.7.1 to 6.8.0, coverage, fastapi-cloud-cli, lefthook, regex and tzdata. No prereleases in the lock.
• uv is pinned in CI: every astral-sh/setup-uv step (ci, security, publish) passes version: "0.12.13", the org's CI standard for Python repos, matching python-sdk.
• The osv-scanner binary the Dependency Scan job downloads moves from v2.5.1 to v2.6.0.
• Hook and CI parity: the pre-push hook ran vulture . --exclude .venv while CI ran vulture agentscore_commerce/, so CI never ran the check the hook runs over tests/ and examples/. CI now runs the hook's scope; it passes today.
• Version 2.9.0 to 2.9.1, with uv.lock re-locked so its embedded version matches.

Checked and found current: every bounded dependency sits at its PyPI latest (x402 2.22.0, pympp 0.11.0, cdp-sdk 1.48.1, stripe 15.6.1, redis 8.1.0, joserfc 1.7.5, httpx 0.28.1), so no upper bound is holding back a release. pympp and x402 did not move, so neither needs the registry's move checks. Actions: setup-uv@v10.1.0, pypa/gh-action-pypi-publish@v1.14.2, actions/setup-python@v7, actions/checkout@v7, actions/cache@v6, useblacksmith/checkout@v1 are all current. Dependabot covers uv and actions.

Not taken: web3 stays on 7.16.0 though 8.0.0 is out and stable. Nothing bounds it directly (cdp-sdk, x402 and pytempo all declare web3>=7.x), but forcing web3>=8 makes the resolver downgrade pympp from 0.11.0 to 0.9.1, since pympp 0.11's tree does not accept web3 8. The newest pympp on the payment path outranks a transitive web3 major, so the resolver's choice is the right one; it moves when pympp's tree allows it.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

From uv sync --frozen --all-extras --all-groups: ruff check, ruff format --check, ty check agentscore_commerce/, ty check on examples, vulture . --min-confidence 80 --exclude .venv, and pytest (1869 passed, 4 skipped, 95.37% coverage against the 95% bar), all exit 0; uv build exit 0. osv-scanner 2.6.0 over uv.lock: 144 packages, no issues. pip-audit over the exported requirements: exit 0.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge.