Refresh the dev toolchain lock, release 2.6.3

[vvillait88]

Summary

Routine dependency pass over the whole tree. Only one package had a newer version inside its declared range: ty 0.0.65 to 0.0.66, a dev-group type checker. Everything else is already current.

Reported so the next pass does not re-derive it: httpx (the single runtime dependency) is current within >=0.25.0,<1.0.0, and the lockfile carries no advisories under either scanner.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. pyproject.toml is untouched; the diff is uv.lock alone. ty is a dev-group tool that no consumer resolves, so no release is needed and no caller has to act.

Test plan

• uv sync --all-extras --all-groups --upgrade, then:
• uv run ruff check . all checks passed
• uv run ruff format --check . 21 files already formatted
• uv run ty check agentscore/ all checks passed
• uv run pytest tests/: 183 passed, 8 skipped, 100.00% coverage (gate is 95%)
• osv-scanner v2.4.0 over uv.lock: no issues found

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Scope grew after the original body: this branch now also bumps pyproject.toml to 2.6.3 for release, so the "no release is needed" line in the Public API section above no longer describes the branch.

The published wheel is functionally identical to 2.6.2. The only dependency change is ty, a dev-group type checker that no consumer resolves, so 2.6.3 is a maintenance release rather than a behavior change and callers have nothing to migrate.

uv.lock was re-locked in the same commit, because it embeds the project's own version and a bare pyproject.toml bump leaves the two files disagreeing about what the package is with nothing to catch it.

Gates re-run after the bump: ruff check, ty check, and pytest (183 passed, 8 skipped, 100% coverage) all green.