chore: release 3.1.0 (#154)

## Summary

Releases 3.1.0, carrying everything merged since 3.0.0:

- the quota denial message no longer tells an agent to retry, at all six
adapters (#153)
- `to_security_requirements` exported from `identity` and the package
root (#151), which is the new public surface that makes this a minor
- A2A signing docs and supported versions corrected, README notes on UCP
`keys[]` (#150, #152)
- fastapi 0.142 resolves under the `if-necessary` prerelease rule with
the `web3<8` constraint (#149)

Also in this PR: `agentscore-py` floor raised to 2.7.1 (released today),
and the `web3<8` comment now states the real blocker. web3 8.0.0 is
stable, but it needs eth-abi 6, which pympp's `tempo` extra excludes
(`eth-abi<6`, pympp 0.11.0 is the latest), so an unconstrained re-lock
lands on the 8.0.0b3 beta and pinning 8.0.0 downgrades pympp to 0.9.1. I
tried the lift: the beta resolution passed the suite, but shipping a
beta to merchants is the thing the constraint exists to prevent.

Worked with: Varun.

Out of scope: lifting `web3<8`, which waits on pympp admitting eth-abi
6.

## Type of change

- [ ] Bug fix (no breaking change)
- [x] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

`to_security_requirements` is newly exported (merged in #151). Nothing
removed or changed.

## Test plan

`ruff check`, `ruff format --check`, `ty check` and `pytest` (1893
passed, 4 skipped, 95.41% coverage) pass locally on this branch.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "3.0.0"
+version = "3.1.0"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "agentic-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.7.0",
+    "agentscore-py>=2.7.1",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -114,10 +114,11 @@ filterwarnings = [
 
 [tool.uv]
 required-version = ">=0.11.0"
-# cdp-sdk, pytempo and x402 all require `web3` with no upper bound, and solana
-# 0.41 needs a websockets that only the web3 8 beta allows, so a bare
-# `uv lock --upgrade` walks onto web3 8.0.0b3. The constraint keeps web3 on its
-# stable line. `if-necessary` admits a prerelease only for a package that has
+# cdp-sdk, pytempo and x402 all require `web3` with no upper bound. Stable web3
+# 8 needs eth-abi 6, which pympp's `tempo` extra excludes (`eth-abi<6`), so a
+# bare `uv lock --upgrade` walks onto the 8.0.0b3 beta instead, and pinning
+# 8.0.0 downgrades pympp. The constraint keeps web3 on 7 until pympp admits
+# eth-abi 6. `if-necessary` admits a prerelease only for a package that has
 # never published anything else: OpenTelemetry's semantic-conventions family,
 # which fastapi 0.142's `standard` extra reaches through opentelemetry-sdk.
 # `disallow` held fastapi back silently and failed Dependabot outright.