chore(deps): bump 20 packages to latest compatible versions

[datasciencemonkey]

Summary

• Upgrades 20 transitive and direct dependencies to latest compatible versions
• All tests pass (117/118, 1 pre-existing failure unrelated to deps)
• protobuf intentionally kept at 6.x (7.x is a major version bump requiring separate validation)

Package Updates

Package	From	To	Type
claude-agent-sdk	0.1.58	0.1.65	direct
databricks-sdk	0.102.0	0.103.0	direct
certifi	2026.2.25	2026.4.22	transitive (CA certs)
mcp	1.26.0	1.27.0	transitive
opentelemetry-sdk	1.40.0	1.41.0	transitive
opentelemetry-api	1.40.0	1.41.0	transitive
opentelemetry-proto	1.40.0	1.41.0	transitive
opentelemetry-semantic-conventions	0.61b0	0.62b0	transitive
pydantic	2.12.5	2.13.3	transitive
pydantic-core	2.41.5	2.46.3	transitive
pydantic-settings	2.13.1	2.14.0	transitive
uvicorn	0.44.0	0.45.0	transitive
fastapi	0.135.3	0.136.0	transitive
click	8.3.1	8.3.3	transitive
google-auth	2.49.1	2.49.2	transitive
gitpython	3.1.46	3.1.47	transitive
idna	3.11	3.13	transitive
cachetools	7.0.5	7.0.6	transitive
packaging	26.0	26.1	transitive
zipp	3.23.0	3.23.1	transitive

Supersedes Dependabot PRs

This PR covers all the bumps proposed by the following open Dependabot PRs, which can be closed:

Closes #144 (mcp 1.26.0 → 1.27.0)
Closes #143 (opentelemetry-sdk 1.40.0 → 1.41.0)
Closes #129 (opentelemetry-semantic-conventions 0.61b0 → 0.62b0)
Closes #125 (zipp 3.23.0 → 3.23.1)

Not included: #131 (protobuf 6.x → 7.x) — major version bump, requires separate validation.

Test plan

• Core test suite passes (117/118, 1 pre-existing failure in test_session_detach.py)
• Telemetry, auth, PAT rotation, gateway discovery, upload, WS auth, CLI token tests all green
• requirements.lock regenerated with hashes