chore(deps): remove pyjwt constraint-dependencies when mcp bumps its floor

## Context

Issue #266 adds `constraint-dependencies = ["pyjwt>=2.13.0"]` to `agent/pyproject.toml` as a workaround for PYSEC-2026-175/177/178/179. This constraint is needed because `mcp` (v1.27.1) transitively pulls in pyjwt but hasn't bumped its own floor to >=2.13.0 yet.

## When to action

When `mcp` releases a version whose own dependency tree resolves pyjwt >=2.13.0 naturally (i.e., the constraint becomes redundant).

**How to check:** After bumping `mcp` in `agent/pyproject.toml`, temporarily remove the constraint and run `uv lock`. If pyjwt resolves to >=2.13.0 without the constraint, it's safe to remove.

## What to do

1. Remove the `pyjwt>=2.13.0` line from `[tool.uv] constraint-dependencies` in `agent/pyproject.toml`
2. If no other entries remain, remove the entire `[tool.uv]` section
3. Run `uv lock` to regenerate
4. Verify `osv-scanner` still passes (pyjwt should be >=2.13.0 from mcp's own deps)

## Acceptance Criteria

- [ ] `constraint-dependencies` for pyjwt removed from `agent/pyproject.toml`
- [ ] `agent/uv.lock` regenerated cleanly
- [ ] `osv-scanner` pre-push hook still passes

mcp のリリースで pyjwt が >=2.13.0 に解決されるまで待ち、その後 agent/pyproject.toml を調査して制約を一時的に削除します。uv lock を実行し、agent/uv.lock が正常に再生成されることを確認して、osv-scanner の pre-push フックを実行します。制約と空の [tool.uv] セクションが削除され、pyjwt が必要なバージョンのままであれば完了です。

索引モデルが issue の本文から書いたものです。