Sweep dependencies, pin uv in CI, and bump to 2.6.10

[vvillait88]

Summary

Dependency sweep for python-sdk, plus the release bump to 2.6.10.

• uv lock --upgrade: coverage 7.16.0 to 7.16.1 and lefthook 2.1.12 to 2.1.14 (dev tooling). No prereleases in the lock; prerelease = "disallow" stays.
• uv itself is now pinned in CI: every astral-sh/setup-uv step (ci, security, publish) passes version: "0.12.13", the current uv release, which is the org's CI standard for Python repos. Without it, CI installed whatever uv was newest under required-version.
• The osv-scanner binary the Dependency Scan job downloads moves from v2.5.1 to v2.6.0. Both of these pins are workflow inputs, so dependabot never proposes them.
• Version 2.6.9 to 2.6.10, with uv.lock re-locked so its embedded project version matches.

The one runtime dependency, httpx>=0.25.0,<1.0.0, resolves to 0.28.1, which is httpx's latest release.

Checked and found current: astral-sh/setup-uv@v10.1.0, pypa/gh-action-pypi-publish@v1.14.2, actions/setup-python@v7 (v7.0.0), actions/checkout@v7, actions/cache@v6, useblacksmith/checkout@v1; dependabot config (uv and actions ecosystems); hook/CI parity (hooks run ruff check, ruff format, ty and vulture; CI adds pytest).

Not changed, deliberately: CI tests on Python 3.12 and the audit job runs 3.13. That is a test-matrix choice, not a dependency pin, and requires-python stays >=3.11.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

Locally, from uv sync --frozen --all-extras --all-groups: ruff check, ruff format --check, ty check agentscore/, vulture, pytest (183 passed, 8 skipped, 99.85% coverage against the 95% bar) and uv build, all exit 0. osv-scanner 2.6.0 over uv.lock: 24 packages, no issues. pip-audit over the exported requirements: exit 0. The three workflow files parse, and each setup-uv step carries the version input.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge.