Sweep dependencies, take agentscore-py 2.6.11 and x402 2.23.0, and bump to 2.9.2

[vvillait88]

Summary

Dependency sweep for python-commerce, plus the release bump to 2.9.2. The agentscore-py floor moves to 2.6.11 (released today). The lock upgrade takes x402 2.23.0, sentry-sdk 2.69.2, urllib3 2.8.0, yarl 1.25.1, propcache 0.5.4, idna 3.20, ruff 0.16.8 and ty 0.0.82, and scans clean for prereleases. x402 2.23.0 was read from the sdist rather than its version, per the holds registry: the EVM constants block (the Base USDC domain we depend on) is byte-identical to 2.22.0; the facilitator client's default timeout rises from 30s to 90s; the FastAPI and Flask middleware now initialize at construction when sync_facilitator_on_start is set and exit the process on a fatal capability mismatch, which does not reach this library because it uses only x402's schemas and settle types; the bazaar route template decodes to a fixed point. The uv version the three workflows pass as a setup-uv input moves from 0.12.13 to 0.12.16.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Run locally on this branch after uv lock --upgrade and uv sync --all-extras --all-groups: ruff check, ruff format --check, ty check agentscore_commerce/, ty check over examples, vulture, and pytest tests/ --cov=agentscore_commerce (1869 passed, 4 skipped, 95% coverage). Nothing runtime changed on our side, so no new tests. Release: tag v2.9.2 after merge and watch the publish run; core's store takes it next.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests