(chore): Relax `google-adk<2.2` pin to unblock starlette 1.x

[krisztianfekete]

pyproject.toml:12 pins google-adk[eval]>=2.1.0,<2.2, which holds starlette at 0.x. That leaves 4 CVEs unfixable, two of them HIGH (CVE-2026-48818, CVE-2026-54283), and starlette is in the request path for every endpoint we serve. Surfaced in #182, which cleared everything else.

Getting to starlette >=1.3.1 needs google-adk >=2.6.

This needs some testing.

First question is whether <2.2 was a known incompatibility or just defensive. It came in with 709322d (KubernetesSecretsResolver), which suggests defensive. If so this might be cheap.

• Work out why <2.2 is there
• Try adk 2.6+, see what breaks in builtin_metrics.py / evaluator/sources.py
• Confirm starlette lands >=1.3.1
• Check test_credential_injection.py still holds