Take the minor-patch group and cut 2.6.6

[vvillait88]

Summary

Dependency sweep for this repo: idna 3.19, pygments 2.21.0, python-dotenv 1.2.3,
ruff 0.16.4 and ty 0.0.73. All are dev tooling or transitives. No declared
dependency range in pyproject.toml changed, so nothing here reaches a consumer.

The version bump to 2.6.6 is deliberate rather than required: nothing in this diff
obliges a caller to act. It exists so the SDK ships as tier 1 of a coordinated
release across the SDKs, the commerce libraries and pay, which was Varun's call
after I flagged that by the usual "bump only where a consumer must act" rule this
repo did not need a release at all.

uv.lock embeds the project's own version, so it is re-locked in the same commit
rather than left naming 2.6.5.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported symbol, signature, wire format or response shape changes. The
only non-lockfile edit is the version field.

Test plan

Ran the repo's full gate set locally on this branch:

• uv run ruff check . clean
• uv run ruff format --check .: 21 files already formatted
• uv run ty check agentscore/ clean
• uv run vulture . vulture_whitelist.py --min-confidence 80 --exclude .venv clean
• uv run pytest tests/ -q: 183 passed, 8 skipped, 100% coverage against a 95% floor
• osv-scanner over uv.lock: no issues found across 24 packages

No tests were added or changed, because no behavior changed.

Checklist

• Tests cover the new behavior, and the suite passes locally
  (no new behavior; the existing suite passes unchanged)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (public surface did not change, so nothing to update)
• No secrets, credentials, or personal data in the diff or the tests

Deliberately not done

• Consumer floors are not raised to >=2.6.6 in python-commerce or core/store.
  That version does not exist on PyPI yet, so raising a floor now would make
  uv lock unresolvable. The existing ranges already accept it, so no consumer
  edit is needed; pinning to the exact tested combination is a follow-up after
  this publishes.
• No tag pushed. The publish workflow fires on v*, and a PyPI version is
  permanent, so the tag is left for a deliberate step after this merges.