fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34515 open redirect

Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to
remediate CVE-2026-34515, a high-severity open redirect vulnerability in
aiohttp that affects the A2A server HTTP transport, MCP tool source
fetching, and agent communication layers.

The uv.lock already resolves aiohttp to 3.13.5 which satisfies the
>=3.13.4 constraint. Adding the explicit constraint ensures vulnerable
versions (<3.13.4) cannot be installed even if upstream transitive
dependency constraints are loosened.

ISSUES CLOSED: #1544

pyproject.toml

@@ -47,6 +47,7 @@ dependencies = [
     "jsonschema>=4.20.0",  # JSON Schema validation for tool inputs/outputs
     "tomlkit>=0.13.0",  # TOML writing with comment preservation for config CLI
     "tenacity>=8.2.0",  # Retry framework for service layer resilience
+    "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability
 ]
 
 [project.optional-dependencies]