deps: bump claude-agent-sdk floor to >=0.2.130 (allowedTools injection fix + bundled CLI 2.1.222 security fixes)

[olegbrok]

What

Raise the pin in pyproject.toml from claude-agent-sdk>=0.2.127,<0.3 to >=0.2.130,<0.3.

Why

Released 2026-08-04:

• 0.2.129 validates skill names passed to the CLI's --allowedTools, closing a permission-rule injection via crafted names (#1145). PinkyBot does not use ClaudeAgentOptions.skills today (verified: streaming_session.py / sdk_runner.py pass only allowed_tools/disallowed_tools, sourced from operator config in the registry DB), so we are neither broken by the new validation nor currently exposed — this is defense-in-depth for any future use.
• 0.2.129/0.2.130 bundle Claude CLI 2.1.221/2.1.222, which carry three security fixes: a zsh [[ ]] permission-check bypass, worktree-isolated sessions being able to run destructive git against the main checkout, and PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks. SDK-transport agents (persik, ryzhik) run the bundled CLI, so the floor bump is what actually delivers these fixes to them. tmux-transport agents already have 2.1.222 via system CC autoupdate.

Notes

• Prod venv currently holds 0.2.128, which satisfies today's pin — nothing forces the upgrade without this bump.
• The 0.2.129 breaking change (ValueError on malformed skills=[...] names at connect) is a no-op for us per the above.
• After bumping: .venv/bin/python -m pip install -e '.[all]' on the Mini (venv pip works again as of self-update: repo_dir/interpreter contract unguarded — daemon silently ran from a /tmp worktree (08-04 incident) #1000 remediation), then daemon restart.

🤖 Opened by Barsik