Bump to 2.5.18: agentscore-py 2.6.4, x402 2.19.0, and routine deps

[vvillait88]

Summary

Version bump to 2.5.18 plus the full dependency sweep, together so one release carries both.

• agentscore-py floor raised to 2.6.4, the version just published from the sdk repo.
• x402 2.18.0 to 2.19.0. This was held on a previous pass for lacking protocol-field evidence; the evidence was gathered rather than the hold re-carried. Both wheels were unpacked and compared, and every protocol-governed field count is identical (maxAmountRequired 16, x402Version 105, decimals 2300, payTo 26, asset 1333, scheme 1068), so nothing on the wire contract moved. Five files differ, and the one that matters is a security fix: x402_http_server_base normalized the request path by decoding percent-escapes globally, so a decoded byte could create a segment boundary the router never saw, and a wildcard tail carrying a decoded line feed failed to match its own route, skipping payment verification and settlement. 2.19.0 decodes one segment at a time, re-escapes any separator a decode yields, and compiles the route regex with DOTALL.
• stripe 15.5.0, trio 0.34.0, ty 0.0.70.

2.19.0's only constants.py change is Monad Mainnet's USDC name ("USD Coin" to "USDC"), a chain we do not settle on. Base mainnet keeps "USD Coin" in both versions, which is the value the EIP-712 domain hash depends on, so signature verification on our rail is untouched. That was checked by reading the network block rather than inferred from the field name.

Six transitives stay behind latest (websockets, pydantic-core, eth-keyfile, construct-typing, parsimonious, jsonalias). Each is constrained by its parent (pydantic, solana, web3, sanic, eth-abi, solders) rather than by anything this repo declares, so forcing them would override a peer's own resolution. They move when their parents move.

This release should land after the Solana confirmation-timeout fix (#109) so the published version carries both.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported type, function signature, wire format, or response shape changes. The x402 peer moves within its existing >=2.9,<3 range, so no caller migration.

Test plan

Full local gate set on the upgraded lock: ruff check and ruff format --check (215 files) clean, ty check agentscore_commerce/ clean, and pytest tests/ at 1841 passed / 4 skipped with coverage 95.36% against the 95% floor. No test changes were needed since no behavior in this repo changed; the x402 fix is upstream and covered by its own suite. Reproduce with uv sync --all-extras && uv run pytest tests/.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests