fix(security): constrain pyjwt >=2.13.0 (PYSEC-2026-175/177/178/179) (#268)

pyjwt 2.12.1 (transitive via mcp) has 4 known CVEs including one High
(CVSS 7.4). Add uv constraint-dependencies to force >=2.13.0 resolution
without waiting for mcp to bump its own floor.

Closes #266

Co-authored-by: bgagent <345885+scottschreckengaust@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scottschreckengaust

agent/pyproject.toml

@@ -36,6 +36,11 @@ dependencies = [
     "cedarpy==4.8.0", #https://github.com/k9securityio/cedar-py — EXACT pin (no ^/~), parity with @cedar-policy/cedar-wasm@4.10.0
 ]
 
+[tool.uv]
+constraint-dependencies = [
+    "pyjwt>=2.13.0",  # PYSEC-2026-175/177/178/179 — transitive via mcp; remove when mcp bumps floor (#267)
+]
+
 [tool.bandit]
 exclude_dirs = ["tests", ".venv"]
 skips = [