Possible fix(deps): python-multipart 0.0.28 → 0.0.30 (CVE-2026-53539) in uv.lock

Spotted what might be an issue in `agent-core/uv.lock` around line 1.

The python-multipart library contains a ReDoS vulnerability (CVE‑2026‑53539) in its QuerystringParser. When parsing application/x‑www‑form‑urlencoded bodies that use ';' as a field separator and contain no '&', the parser performs a full scan for '&' on each iteration before falling back to locating the nearby ';'. This results in O(B²) byte‑comparisons for N ';'‑separated fields, allowing an attacker to exhaust CPU with a crafted body like "a;a;a;...". The impact is high‑severity denial of service, potentially crashing worker processes under load. The fix is to upgrade python‑multipart to version 0.0.30 or later, which corrects the scanning logic.

Something like this might fix it:

```diff
--- a/agent-core/uv.lock
+++ b/agent-core/uv.lock
@@ -1 +1 @@
-python-multipart==0.0.28
+python-multipart==0.0.30
```

For reference: rule `CVE-2026-53539`. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*