chore: repair original PyJWT dependency PR tracked version #139

Parent: https://github.com/MachineWisdomAI/WisdomHelm/issues/93
Merge when clean: yes

Bounded routine security dependency maintenance of ORIGINAL Dependabot PR137: #137 . Reconciled October5: no root/issue owns this PR; FAVA132 is a separate blocked local-Laya installation, preserve it. Head e492086 changes only uv.lock PyJWT2.13.0->2.15.0; current base/stable0.8.0 source96619955c990ac4ede6c50ce8ab5271b7e92b288. Test matrix/ValidatePR pass, required Versionpolicy37074320953 fails.

Written plan: read FAVA AGENTS/current PR/base/.version-policy; verify upstream PyJWT release/security compatibility, actual FAVA dependency resolution and relevant JWT use, without asserting exploitability or inherited runtime remediation. Use assigned isolated worktree, fetch ORIGINAL Dependabot branch, merge current main normally as needed; fast-forward worker-identity commits only. Run local version updater using current Conventional Commit PR title/current main and configured mirrors/lock coherence, one chore patch increment. Preserve tests and meaningful detection; run documented affected checks and exact CI. Report original repaired_pr URL/currenthead, security/compatibility evidence and six-question audit. First Officer natively independently reviews bot PR and normally protected-merges only exact green/currenthead. No replacement PR or fabricated worker authorship/canonical adoption. If push denied report actual obstacle, never switch identity.

No worker merge/tag/release/install, no FAVA132/localmodel/config/client restart, gateway/server data edits or runtime risk acceptance. Lock change is not proof of fixing PyJWT inside Helmet's immutable base. Max2workers alongside core39; standing configured OpenRouter fallback/no monetary cap, preserve billing/accounts. Candidate cutoff remains exact existing releases; updater publishes nothing.