uv: let fastapi 0.142 resolve (prerelease if-necessary, web3<8) - #149

## Summary

Replaces `prerelease = "disallow"` with `prerelease = "if-necessary"`,
matching python-commerce (agentscore/python-commerce#149). A blanket
`disallow` also refuses packages that have never published a stable
version, and uv then silently keeps an older version of whatever needs
them; that held fastapi back in python-commerce and core's store and
failed Dependabot outright. `if-necessary` admits a prerelease only
where no stable release exists, and any package that reaches for a beta
it does not need gets its own constraint (python-commerce pins `web3<8`;
nothing in this tree needs one).

This tree relocks with no changes and no prereleases.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. `[tool.uv]` is development-only, so no release.

## Test plan

`uv lock --upgrade` reports no changes, no `a`/`b`/`rc` version in
`uv.lock`, and `uv run pytest tests` passes (177 passed, 2 skipped).

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed (no
public surface changed)
- [x] No secrets, credentials, or personal data in the diff or the tests

## Summary

Releases 3.1.0, carrying everything merged since 3.0.0:

- the quota denial message no longer tells an agent to retry, at all six
adapters (#153)
- `to_security_requirements` exported from `identity` and the package
root (#151), which is the new public surface that makes this a minor
- A2A signing docs and supported versions corrected, README notes on UCP
`keys[]` (#150, #152)
- fastapi 0.142 resolves under the `if-necessary` prerelease rule with
the `web3<8` constraint (#149)

Also in this PR: `agentscore-py` floor raised to 2.7.1 (released today),
and the `web3<8` comment now states the real blocker. web3 8.0.0 is
stable, but it needs eth-abi 6, which pympp's `tempo` extra excludes
(`eth-abi<6`, pympp 0.11.0 is the latest), so an unconstrained re-lock
lands on the 8.0.0b3 beta and pinning 8.0.0 downgrades pympp to 0.9.1. I
tried the lift: the beta resolution passed the suite, but shipping a
beta to merchants is the thing the constraint exists to prevent.

Worked with: Varun.

Out of scope: lifting `web3<8`, which waits on pympp admitting eth-abi
6.

## Type of change

- [ ] Bug fix (no breaking change)
- [x] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

`to_security_requirements` is newly exported (merged in #151). Nothing
removed or changed.

## Test plan

`ruff check`, `ruff format --check`, `ty check` and `pytest` (1893
passed, 4 skipped, 95.41% coverage) pass locally on this branch.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests