chore(deps): remove pyjwt constraint-dependencies when mcp bumps its floor

Context

Issue #266 adds constraint-dependencies = ["pyjwt>=2.13.0"] to agent/pyproject.toml as a workaround for PYSEC-2026-175/177/178/179. This constraint is needed because mcp (v1.27.1) transitively pulls in pyjwt but hasn't bumped its own floor to >=2.13.0 yet.

When to action

When mcp releases a version whose own dependency tree resolves pyjwt >=2.13.0 naturally (i.e., the constraint becomes redundant).

How to check: After bumping mcp in agent/pyproject.toml, temporarily remove the constraint and run uv lock. If pyjwt resolves to >=2.13.0 without the constraint, it's safe to remove.

What to do

1. Remove the pyjwt>=2.13.0 line from [tool.uv] constraint-dependencies in agent/pyproject.toml
2. If no other entries remain, remove the entire [tool.uv] section
3. Run uv lock to regenerate
4. Verify osv-scanner still passes (pyjwt should be >=2.13.0 from mcp's own deps)

Acceptance Criteria

• constraint-dependencies for pyjwt removed from agent/pyproject.toml
• agent/uv.lock regenerated cleanly
• osv-scanner pre-push hook still passes

Attendez qu’une version de mcp résolve pyjwt en >=2.13.0, puis inspectez agent/pyproject.toml et supprimez temporairement la contrainte. Exécutez uv lock, vérifiez que agent/uv.lock est régénéré correctement, puis exécutez le hook pre-push de osv-scanner. C’est terminé lorsque la contrainte et toute section [tool.uv] vide ont été supprimées, tandis que pyjwt reste à la version requise.