fix(deps): require PyJWT >=2.13.0 for VULN-88811

[shuningc]

Summary

• Remediate VULN-88811: JWK/HMAC confusion when verifying JWTs with mixed asymmetric + HMAC support (fixed in 2.13.0).
• pyproject.toml: require pyjwt >=2.13.0,<3.0.0 (was >=2.12.0).
• poetry.lock and example pins updated to 2.13.0.

Test plan

• poetry check
• Installed pyjwt 2.13.0; poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88811

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, well-scoped security bump. One incidental lockfile change worth noting below.

---

P3 — Lockfile regenerated with Poetry 2.4.1 introduces unrelated churn (Claude Code)

File/Section: examples/agent/langgraph-fsi-agent/before/poetry.lock
Issue: This lockfile was regenerated with Poetry 2.4.1 (previously 2.1.3), introducing unrelated changes alongside the pyjwt bump: a new ruff 0.15.22 dev entry, reordered urllib3 markers, tweaked typing-extensions description, and normalized jsonschema-specifications spec. None affect runtime behavior, but they widen the diff surface for a security-only PR.
Evidence: Diff shows +# ... Poetry 2.4.1, new [[package]] name = "ruff" block, and marker reorderings.
Recommended fix: Acceptable as-is; consider noting the Poetry version upgrade and lock regeneration in the PR description so reviewers know the extra churn is intentional.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified incidental lockfile churn from Poetry version upgrade