Sweep deps, block prereleases, drop a withdrawn-advisory constraint, cut 2.7.1

[vvillait88]

Summary

Dependency sweep: 16 stable packages, including cdp-sdk 1.48.0, stripe 15.5.1,
sentry-sdk 2.68.0, uvicorn 0.52.4, x402 2.20.0, ruff 0.16.4 and ty 0.0.73. No
declared dependency range in pyproject.toml changed, so nothing reaches a
consumer.

Two pyproject.toml changes worth calling out on their own.

prerelease = "disallow". cdp-sdk, pytempo and x402 all require web3 with
no upper bound, so a bare uv lock --upgrade walked onto web3 8.0.0b3 and
dragged websockets 17 and solders 0.29 along with it. A published SDK must not
ship a beta to every consumer. Disallowing prereleases outright is the right
shape rather than pinning one package, because the same unbounded requirement
exists on several transitives. Adding the setting reverted web3 to stable 7.16.0
and put websockets and solders back, which is how I know the beta was what was
pulling them.

Dropped constraint-dependencies = ["fastapi!=0.136.3"]. It cited
MAL-2026-4750, which now sits in the OSSF malicious-packages withdrawn/
directory. fastar is a legitimate package (Rust tar bindings, public repo) that
fastapi-cloud-cli 0.23.0 declares outright, so the "typosquat" reading in the
old comment is not accurate. The constraint also did not do what the comment
claimed: fastar resolves into the tree regardless, because this repo is on
fastapi 0.141.1, five minors past the version being excluded. Re-locking after
removal left fastapi on 0.141.1, so nothing actually moved.

uv.lock embeds the project's own version, so it is re-locked in the same commit
rather than left naming 2.7.0.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported symbol, signature, wire format or response shape changes. The
non-lockfile edits are the two [tool.uv] settings above and the version field.

x402 2.19.0 to 2.20.0 sits on a wire contract, so it was scoped rather than taken
on the version number: protocol-governed field counts (maxAmountRequired 16,
x402Version 105) are identical across the two, the constants change is additive
error codes, and the one name change is Monad Mainnet's USDC, a network this
package's consumers do not settle on.

Test plan

Ran the repo's full gate set locally on this branch:

• uv run ruff check . clean
• uv run ruff format --check .: 216 files already formatted
• uv run ty check agentscore_commerce/ clean
• uv run vulture . --min-confidence 80 --exclude .venv clean
• uv run pytest tests/ -q: 1863 passed, 4 skipped, 95.37% coverage against a 95% floor
• osv-scanner over uv.lock: no issues found across 141 packages
• Swept every lockfile in the workspace for prerelease versions afterwards: none

No tests were added or changed, because no behavior changed.

Checklist

• Tests cover the new behavior, and the suite passes locally
  (no new behavior; the existing suite passes unchanged)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (public surface did not change, so nothing to update)
• No secrets, credentials, or personal data in the diff or the tests

Deliberately not done

• The agentscore-py floor stays >=2.6.4 rather than moving to the freshly
  published 2.6.6. Nothing in this diff needs it, and tightening a floor on a
  public package forces an upgrade on external consumers for no reason. The
  existing range already accepts it.
• No tag pushed. The publish workflow fires on v* and a PyPI version is
  permanent, so the tag is a deliberate step after this merges.