fix: refresh lockfile with aiohttp 3.13.5 (#208)

## Summary

This PR now reflects the remaining effective diff after merging latest
`main`: a lockfile-only refresh. The LiteLLM vulnerability remediation
originally described here has already landed through PR #209.

## Current change

- `uv.lock`: updates `aiohttp` from `3.13.4` to `3.13.5` and refreshes
the associated package artifact hashes/URLs.

## Relationship to PR #209

PR #209 already landed the substantive AgentEx dependency vulnerability
fixes:

- `litellm >=1.83.7,<2`
- `python-dotenv >=1.2.2,<2`
- `python-multipart >=0.0.26`
- `httpx[http2] >=0.28.1,<0.29` workspace override
- integration test updates for httpx 0.28 request serialization behavior

Because latest `main` already includes those changes, this PR no longer
carries the LiteLLM/security remediation itself.

## Verification

- [x] Rebased/merged against latest `main`
- [x] `uv lock --locked`
- [x] GitHub CI checks passing

## Merge note

Safe to merge as a small lockfile refresh, but it is no longer required
for the LiteLLM vulnerability fix. That work is already present on
`main` via PR #209.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: scale-ballen