uv: prerelease if-necessary, matching python-commerce (#98)

## Summary

Replaces `prerelease = "disallow"` with `prerelease = "if-necessary"`,
matching python-commerce (agentscore/python-commerce#149). A blanket
`disallow` also refuses packages that have never published a stable
version, and uv then silently keeps an older version of whatever needs
them; that held fastapi back in python-commerce and core's store and
failed Dependabot outright. `if-necessary` admits a prerelease only
where no stable release exists, and any package that reaches for a beta
it does not need gets its own constraint (python-commerce pins `web3<8`;
nothing in this tree needs one).

This tree relocks with no changes and no prereleases.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. `[tool.uv]` is development-only, so no release.

## Test plan

`uv lock --upgrade` reports no changes, no `a`/`b`/`rc` version in
`uv.lock`, and `uv run pytest tests` passes (177 passed, 2 skipped).

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed (no
public surface changed)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

pyproject.toml

@@ -63,7 +63,8 @@ include = ["agentscore"]
 required-version = ">=0.11.0"
 # An unbounded transitive requirement lets a routine refresh resolve a BETA and
 # drag a subtree with it, and the tests pass either way, so nothing reports it.
-# That is how python-commerce once resolved web3 8.0.0b3 through three
-# unbounded parents. Blocking prereleases outright beats pinning whichever
-# package surfaced last, since the same shape exists on several transitives.
-prerelease = "disallow"
+# `if-necessary` admits a prerelease only for a package that has never shipped
+# a stable release; a package that reaches for a beta it does not need gets its
+# own constraint (python-commerce pins web3 below 8). A blanket `disallow` also
+# refuses the never-stable packages and silently holds back whatever needs them.
+prerelease = "if-necessary"