Sweep deps, take agentscore-py 2.6.2, cut 2.5.16

[vvillait88]

Summary

Dependency sweep and a version bump so this can be released.

• cryptography 49 to 50, uvicorn 0.52.0 to 0.52.1, coverage 7.15.2 to 7.15.3, bitarray 3.9.2 to 3.10.0.
• The agentscore-py floor moves to >=2.6.2, the version published from python-sdk#71 today.
• Version to 2.5.16.

cryptography is a transitive major that the declared range already allowed, so it would have arrived on the next lock refresh regardless. The suite was run against it rather than the bump being taken on trust.

The agentscore-py floor move is about the declared floor rather than resolution: >=2.6.1 already accepted 2.6.2, and leaving it low is what lets the lock drift back under the version this package is actually tested against.

Unlike the two SDK releases today, this version bump has a substantive reason: the commits since v2.5.15 touched shipped source (aip/http_signature.py, aip/jwks.py), not only CI and tests.

uv.lock was re-locked after the version bump as well as after the dependency changes. The lock embeds the project's own version, so a pyproject.toml bump leaves the two files disagreeing about what the package is with nothing erroring and no gate noticing; it moved 2.5.15 to 2.5.16 here.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported class, function signature, wire format, or 402 body shape changed. The source touched since the last release was spelling inside AIP modules.

The only declared-dependency change a consumer sees is the agentscore-py floor moving to >=2.6.2. That is a patch release of our own SDK with no API change, so no migration follows.

Test plan

• uv run pytest: 1841 passed, 4 skipped, 95.36% coverage against a 95% floor
• ruff check . and ruff format --check .: clean across 215 files
• uv run ty check: clean
• uv run vulture agentscore_commerce/ --min-confidence 80: clean, run through the project's own CI invocation rather than a bare vulture

Reproduce with uv sync --all-extras --all-groups followed by those four commands.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (not applicable)
• No secrets, credentials, or personal data in the diff or the tests