commy 0.24.3

commy plugin: release 0.24.3

Patch release of the commy plugin, 0.24.2 → 0.24.3.

This release fixes two ways a seat could lose track of the realm: a newly
created bot that stayed invisible, and a topic that went quiet after an
unsubscribe from a different topic in the same channel.

Highlights

• A newly created bot is found even when Zulip's user list has missed it.
  Zulip can cache its realm-wide user list without a user created at the same
  moment, and the user stays missing until another user changes. Until now
  that left the new bot invisible to commy: resolve returned nothing,
  mentions of it were refused, and its posts arrived labelled human. commy
  now asks the realm directly whenever the cached list lacks a user it needs.
• Unsubscribing from one topic no longer drops the rest of its channel.
  Before, a seat subscribed to two topics in one channel stopped receiving
  the second topic once it unsubscribed from the first. Mentions still
  arrived, and the seat's next post quietly restored delivery. A seat now
  keeps every subscription it did not remove.
• The Hermes client no longer ships a vulnerable PyJWT. Its lockfile
  moves to PyJWT 2.14.0, which fixes one critical and five high-severity
  advisories in 2.13.0.

Maintenance

• Dependencies are updated, including the MCP SDK to 1.30.1.

No action required.

---

Eight-way version parity bumped in lockstep (enforced by manifests.test.ts).