Security:
- google-adk floor >=1.25 -> >=1.28.1 for CVE-2026-4810 CRITICAL
  (Code Injection + Missing Authentication).
- Pinning sdc-agents>=4.4.0 downstream guarantees the patched substrate.

Fixed:
- CI install uses [dev,bigquery] so BigQuery test patches resolve.
- introspect_bigquery lazy import wrapped with friendly RuntimeError.
- test_get_tools_returns_one uses asyncio.run() (Python 3.11+ safe).

Style:
- Applied black 24.10.0 to introspect.py.