Release 2.8.1: require a certifi without the compromised emSign roots (#111)

## Summary

Release 2.8.1. certifi below 2026.10.19 trusts emSign root certificates
whose intermediate CA keys were compromised (GHSA-6q48-6c7w-9gw2).
Someone holding one of those keys can issue a valid-looking certificate
for any hostname, so a client that trusts them can have its TLS traffic
intercepted by an on-path attacker. The SDK reaches certifi only through
httpx, and httpx accepts any certifi, so an install could still resolve
an affected version.

This release declares `certifi>=2026.10.19` as a direct dependency. Any
environment that installs 2.8.1 gets a certifi without the compromised
roots. The lockfile moves certifi to 2026.10.19.

Worked with Varun.

## Type of change

- [x] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

Unchanged. The one new runtime requirement is `certifi>=2026.10.19`,
which httpx already pulls in.

## Test plan

- `uv sync --frozen --all-extras --all-groups`, then `uv run pytest`
(172 passed, 2 skipped), `uv run ruff check .` (clean); ruff format, ty
and vulture ran green in CI.
- `osv-scanner` on `uv.lock`: no issues found. Before this change it
reported the certifi advisory.

## Checklist

- [ ] Tests cover the new behavior, and the suite passes locally (a
dependency floor adds no behavior to test; the existing suite passes,
172 tests)
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
(the public surface did not change)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

pyproject.toml

@@ -4,14 +4,17 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-py"
-version = "2.8.0"
+version = "2.8.1"
 description = "Python client for the AgentScore APIs"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "x402", "agent", "trust", "wallet", "blockchain", "ai-agent", "agentic-payments"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
+    # Below 2026.10.19, certifi trusts emSign roots whose intermediate keys were
+    # compromised; httpx alone would let an install resolve one.
+    "certifi>=2026.10.19",
 ]
 classifiers = [
     "Development Status :: 4 - Beta",