chore(deps): remove pyjwt constraint-dependencies when mcp bumps its floor

[scottschreckengaust]

Context

Issue #266 adds constraint-dependencies = ["pyjwt>=2.13.0"] to agent/pyproject.toml as a workaround for PYSEC-2026-175/177/178/179. This constraint is needed because mcp (v1.27.1) transitively pulls in pyjwt but hasn't bumped its own floor to >=2.13.0 yet.

When to action

When mcp releases a version whose own dependency tree resolves pyjwt >=2.13.0 naturally (i.e., the constraint becomes redundant).

How to check: After bumping mcp in agent/pyproject.toml, temporarily remove the constraint and run uv lock. If pyjwt resolves to >=2.13.0 without the constraint, it's safe to remove.

What to do

1. Remove the pyjwt>=2.13.0 line from [tool.uv] constraint-dependencies in agent/pyproject.toml
2. If no other entries remain, remove the entire [tool.uv] section
3. Run uv lock to regenerate
4. Verify osv-scanner still passes (pyjwt should be >=2.13.0 from mcp's own deps)

Acceptance Criteria

• constraint-dependencies for pyjwt removed from agent/pyproject.toml
• agent/uv.lock regenerated cleanly
• osv-scanner pre-push hook still passes

[scottschreckengaust]

Current state (2026-06-04):

• mcp is pinned at v1.27.1 in agent/pyproject.toml
• At this version, mcp transitively pulls in pyjwt[crypto] without a >=2.13.0 floor
• The constraint-dependencies workaround was added in PR fix(security): constrain pyjwt >=2.13.0 (PYSEC-2026-175/177/178/179) #268

When to re-check: Next time mcp is bumped (either via Dependabot PR #244 or manually). After bumping, temporarily remove the constraint and run uv lock — if pyjwt resolves to >=2.13.0 without it, this issue can be closed.