fix(deps): cap protobuf<7 in file_organizer and image_service

protobuf 7.x is incompatible with every released opentelemetry: the
opentelemetry-proto package requires protobuf>=5.0,<7.0. Bumping to
protobuf>=7 (Dependabot #507/#510) forces uv to walk the entire
OpenTelemetry stack back to a 2022-era release (1.11.1), which is
incompatible with the retained modern otel-api/sdk and crashes the
agent at startup (test-startup: exit 2, server never binds).

There is no security benefit: the existing protobuf>=6.33.5 pin already
resolves 6.33.6, which mitigates CVE-2026-0994.

Cap protobuf<7 (still >=6.33.5) in both services and re-lock. This also
prevents Dependabot from recreating the major-bump PRs, since they can
no longer satisfy the constraint. Supersedes #507 and #510.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

a2a/file_organizer/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "cryptography>=48.0.0,<49", # Indirect; prevents CVE-2026-26007
     "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
     "orjson>=3.11.6",           # Indirect; prevents CVE-2025-67221
-    "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
+    "protobuf>=6.33.5,<7",      # Indirect; prevents CVE-2026-0994. Cap <7: opentelemetry-proto requires protobuf<7.0 (proto7 downgrades OTel and breaks startup)
     "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
     "pyjwt>=2.13.0",            # Indirect; prevents CVE-2026-32597
 ]

a2a/file_organizer/uv.lock

@@ -23,7 +23,7 @@ dependencies = [
     "aiohttp>=3.14.0",          # Indirect; prevents CVE-2026-34525, CVE-2026-34516, CVE-2026-34515, CVE-2026-22815
     "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
     "orjson>=3.11.6",           # Indirect; prevents CVE-2025-67221
-    "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
+    "protobuf>=6.33.5,<7",      # Indirect; prevents CVE-2026-0994. Cap <7: opentelemetry-proto requires protobuf<7.0 (proto7 downgrades OTel and breaks startup)
     "pyasn1>=0.6.3",            # Indirect; prevents CVE-2026-30922
     "cryptography>=48.0.0,<49", # Indirect; prevents CVE-2026-26007
     "pyjwt>=2.13.0",            # Indirect; prevents CVE-2026-32597