fix(agent-eval-canary): constrain idna>=3.15 for CVE-2026-45409

[kylehounslow]

What

Constrain idna>=3.15 in docker-compose/agent-eval-canary and re-lock. idna resolves 3.11 -> 3.18.

Root cause

idna is a transitive dependency via opensearch-genai-observability-sdk-py (SDK -> requests -> idna). The pinned 3.11 is affected by CVE-2026-45409 (GHSA-65pc-fj4g-8rjx): specially crafted input to idna.encode() bypasses the CVE-2024-3651 length guard and causes excessive CPU consumption. Fixed in idna 3.15.

Fix

Added a [tool.uv] constraint-dependencies = ["idna>=3.15"] floor to the canary's pyproject.toml and regenerated uv.lock. A uv constraint floors the resolved transitive version without adding idna as a direct dependency, so it drops out once the SDK raises its own floor (tracked separately). The lock diff is limited to the constraint entry and the idna package block.

Validation

cd docker-compose/agent-eval-canary
uv sync                          # resolved 26 packages, idna 3.11 -> 3.18
uv sync --frozen --no-dev        # Dockerfile build gate, passes
uv run python -c "import idna, importlib.metadata as m; print(m.version('idna'))"
# 3.18

The canary module imports cleanly against the new lock (SDK, OTel exporters, idna 3.18). The poll loop needs a live OpenSearch backend and was not exercised here.

Closes #241. Part of #357.