fix(security): suppress uv-missing-dependency-cooldown on agent/pyproject.toml (#532) (#539)

* fix(security): suppress uv-missing-dependency-cooldown on agent/pyproject.toml (#532)

semgrep's uv-missing-dependency-cooldown rule wants a global exclude-newer
cooldown under [tool.uv]. Setting one is structurally incompatible with this
repo: deps are exact-pinned (==) and several pins (fastapi, bedrock-agentcore,
boto3) are to versions published within any reasonable cooldown window, so a
global exclude-newer makes `uv lock`/`uv sync` unsatisfiable and re-breaks on
every fresh pin bump.

The rule's threat model (surprise malicious/unstable version) is already
covered by exact pins + committed uv.lock + reviewed upgrade-main PRs +
uv sync --frozen in the image. Suppress with a justified nosemgrep on the line
preceding [tool.uv] rather than adding a redundant, workflow-breaking cooldown.

Approach approved by maintainer (Option B) in #532.

Verified: `mise run security:sast` -> 0 findings; `uv sync --all-groups` and
`uv lock --check` both resolve.

Fixes #532
Co-Authored-By: Claude <noreply@anthropic.com>

* chore: re-trigger CI — clear stuck CodeQL run (#532)

---------

Co-authored-by: Mandeep Singh <mandeep408@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Alain Krok <alkrok@amazon.com>
Co-authored-by: Sphia Sadek <isadeks@gmail.com>

Author: 4 people

agent/pyproject.toml

@@ -49,6 +49,14 @@ dependencies = [
     "jsonschema==4.26.0", #https://pypi.org/project/jsonschema/
 ]
 
+# The uv-missing-dependency-cooldown rule wants a global exclude-newer window.
+# We intentionally do NOT set one: deps are exact-pinned (==) and lockfile-managed
+# via upgrade-main.yml, and a global cooldown conflicts with fresh exact pins
+# (fastapi/bedrock-agentcore/boto3 were published within the last week) — it makes
+# `uv sync` unsatisfiable and re-breaks on every pin bump. The rule's threat model
+# (surprise malicious/unstable version) is already covered by exact pins + reviewed
+# lock upgrades. See #532.
+# nosemgrep: uv-missing-dependency-cooldown
 [tool.uv]
 constraint-dependencies = [
     "pyjwt>=2.13.0",  # PYSEC-2026-175/177/178/179 — transitive via mcp; remove when mcp bumps floor (#267)