## Summary

Two exact-pinned GitHub Actions bumped by hand, from the workspace-wide
maintenance sweep. Exact pins are invisible to dependabot, so they only
move when someone checks them.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. CI tooling only; no shipped code or exported surface changes.

## Test plan

Release notes read rather than assumed. `gh-action-pypi-publish` 1.14.2
is a dependency refresh that takes Twine 7 internally, which allows
uploading distributions carrying core packaging metadata 2.5; no
behavioural change to how this repo publishes. `setup-docker-builder`
2.1.0 adds agent-address discovery and a sticky-disk mount fix, with no
new required inputs (a major is where that risk lives, and this is a
minor).

Every other action in the workspace was checked the same way and is
current: trivy 0.36.0, setup-uv 9.0.0, cosign 4.1.2, setup-atlas 0.3,
claude-code-action 1.0.183, plus the floating majors, which are current
by definition. Version pins passed as workflow inputs, which dependabot
never sees at all, are current too: osv-scanner 2.4.0, python 3.13.

The real gate is the publish workflow itself, which runs on the next
tag.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

## Summary

Dependency sweep for this repo, plus a version bump so it can be
released.

- `coverage` 7.15.2 to 7.15.3, the only available bump.
- Version to 2.6.2.

Same caveat as the node SDK, and it decides whether this is worth
publishing: nothing here reaches a consumer. The only commit since
v2.6.1 is a one-line `ci.yml` change and coverage is a dev dependency,
so the published wheel is unchanged.

`uv.lock` was re-locked after the version bump, not just after the
dependency change. The lock embeds the project's own version, so a
`pyproject.toml` bump leaves it stale with nothing erroring and no gate
noticing: the two files simply disagree about what the package is. It
was sitting at 2.6.1 and `uv lock` moved it to 2.6.2.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

**None.** No exported class, function signature, wire format, or
response shape changed. The published wheel is unchanged; the only
difference is a dev dependency.

No migration for callers. Both consumers in this workspace
(`core/store`, `python-commerce`) declare `agentscore-py>=2.6.1`, which
already accepts 2.6.2, so no manifest edit is required downstream.

## Test plan

No tests added, because no behavior changed. The existing suite was run
to confirm the bump breaks nothing:

- `uv run pytest`: 183 passed, 8 skipped, 100% coverage against a 95%
floor
- `ruff check` and `ruff format --check`: clean
- `uv run ty check`: clean
- `uv run vulture . vulture_whitelist.py --min-confidence 80 --exclude
.venv`: clean

Vulture is run through the project's exact CI invocation rather than a
bare `vulture`, which reports low-confidence findings the project
deliberately filters out and would read as a regression that is not
there.

Reproduce with `uv sync --all-extras --all-groups` followed by those
four commands.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
(not applicable, public surface unchanged)
- [x] No secrets, credentials, or personal data in the diff or the tests