fix(deps): bump langchain 1.3.9 / deepagents 0.6.10 to patch GHSA-gr75-jv2w-4656

Resolves the medium-severity LangChain path-confinement advisory (flagged by Aikido +
pip-audit on PR #230). The patched langchain 1.3.9 requires deepagents 0.6.10, whose
langgraph-sdk caps websockets <16 — so relax the CLI's `websockets>=16` floor (a
dependabot artifact, not a real requirement) to `>=14`; the resolver now picks 15.0.1.

Safe for our usage either way:
- websockets: the realtime STT/TTS code uses websockets.sync/asyncio.client (stable
  since 13.x) and the assemblyai SDK only needs >=11; the full suite passes on 15.0.1.
- the advisory's affected components (langchain file-search middleware / config loaders /
  path-prefix checks) aren't on our path: we use deepagents' LocalShellBackend with
  virtual_mode=True, which confines file/shell tools to the working directory.

Full local suite (3261 tests) + ruff + mypy + lock-check pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mqx2vYy9FS5Lxpf3ekBGsr

Author: claude

pyproject.toml

@@ -38,7 +38,10 @@ dependencies = [
     "pydantic>=2.13.4",
     "platformdirs>=4.10.0",
     "tomli-w>=1.2.0",
-    "websockets>=16.0",
+    # Floor kept at >=14 (not the dependabot-bumped >=16) so the resolver can pick a
+    # 15.x line: deepagents' langgraph-sdk caps websockets <16, and our usage
+    # (websockets.sync/asyncio.client) has been stable since 13.x. assemblyai needs >=11.
+    "websockets>=14",
     "sounddevice>=0.5.5",
     "openai>=2.41.0",
     "yt-dlp>=2026.3.17",
@@ -71,7 +74,7 @@ dependencies = [
     "pypdf>=5.1.0",
     # `assembly code` coding agent (deepagents on the LLM Gateway). Heavy trees,
     # intentionally added on this WIP branch; see aai_cli/code_agent/.
-    "deepagents>=0.6.7",
+    "deepagents>=0.6.10",
     "langchain-openai>=1.3.2",
     "langgraph>=1.2.2",
     "langchain-core>=1.4.7",