Deps: lock refresh (#156)

## Summary

Lock-only dependency refresh: a2a-sdk 1.2.2, aiohttp 3.14.4,
google-api-core 2.41.0, google-auth 2.60.0 and lefthook 2.1.17. The
declared dependency ranges in `pyproject.toml` are unchanged, so the
published package is unaffected and no release is needed. pytempo stays
at 0.5.1 for now.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

No change.

## Test plan

`uv sync --frozen --all-extras` then `uv run pytest`: 1893 passed, 4
skipped. `ruff check`, `ruff format --check` and `ty check` pass.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88