chore(deps): sweep 2026-09-08 (#132)

## Summary

Routine dependency sweep, lock-only. `uv lock --upgrade` moved six
transitive or dev packages: `aiolimiter` 1.2.1 to 1.3.0, `anyio` 4.15.0
to 4.15.1, `rich-toolkit` 0.20.4 to 0.20.5, `sentry-sdk` 2.68.1 to
2.69.1, `ty` 0.0.78 to 0.0.79, `types-requests` to the 2026-09-06 stub
build. No declared range changed and no release is needed.

Audited and current, nothing to move: `x402` 2.22.0, `pympp` 0.11.0 and
`cdp-sdk` 1.48.1 are each at their PyPI latest. `web3` stays 7.16.0:
8.0.0 is GA now, but a targeted upgrade resolves nothing because a
dependent bounds it; nothing prerelease in the lock. GitHub Actions pins
(checkout v7, cache v6, setup-uv v10.0.1, setup-python v7,
gh-action-pypi-publish v1.14.2) are all at upstream latest. OSV scan
over the lock: 144 packages, no issues.

Worked with Varun (varunwadhwa).

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

none

## Test plan

Ran locally after `uv sync --all-extras --all-groups`: `ruff check`,
`ruff format --check`, `ty check`, `vulture agentscore_commerce`,
`pytest` (1868 passed, 4 skipped, 95.37% coverage), all exit 0.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: vvillait88