chore(agent): upgrade Python 3.13 → 3.14

## Summary

Upgrade the agent container base image from `python:3.13-slim` to `python:3.14-slim`.

Related: #104 (toolchain monitoring RFC)

## Risk Assessment: SAFE

Comprehensive codebase analysis shows **zero code changes required**:

| Check | Result |
|-------|--------|
| `requires-python` constraint | `>=3.13` — already permits 3.14 |
| Removed stdlib modules (asyncore, cgi, etc.) | None used |
| Typing features | All stable since 3.11/3.12; PEP 649 compatible |
| Native extension wheels (cedarpy, pydantic-core, grpcio, cffi) | All have cp314 wheels in uv.lock |
| Major deps (boto3, fastapi, uvicorn, opentelemetry, claude-agent-sdk) | All pure-Python or have 3.14 wheels |
| C extensions in agent source | None — all pre-built wheels |
| asyncio event loop policy usage | Diagnostic only; no behavior change in 3.14 |

## Changes Required

1. `agent/Dockerfile` line 11: `python:3.13-slim` → `python:3.14-slim`
2. `agent/pyproject.toml`: `target-version = "py313"` → `"py314"` (ruff)
3. `agent/pyproject.toml`: `python-version = "3.13"` → `"3.14"` (ty)
4. Re-lock: `uv lock` (lockfile already has 3.14 resolution markers)

## Testing Required

- [ ] Docker image builds
- [ ] `uv sync --frozen` works (or re-lock if needed)
- [ ] Agent unit tests pass
- [ ] Trivy image scan passes
- [ ] Smoke test: full agent task execution

## Notes

- Consider doing this **separately** from the Debian trixie upgrade (#106) to isolate variables
- Python 3.14 is stable with 5 patch releases as of May 2026
- The uv.lock already contains resolution markers for `python_full_version >= '3.14'`