fix: pin marvin<3.1.0 to fix contact-extractor crash

[pdettori]

Summary

• Pin marvin>=3.0.0,<3.1.0 in a2a/a2a_contact_extractor/pyproject.toml
• Marvin 3.1.1 removed _deprecated_result_tool_name from Agent, breaking run_async() with union result_type
• uv.lock updated: marvin 3.1.1 → 3.0.6

Root Cause

AttributeError: 'Agent' object has no attribute '_deprecated_result_tool_name'
  File "marvin/engine/streaming.py", line 90, in handle_agentlet_events

Observed in the Kind cluster (team1 namespace) when sending any task to the contact-extractor agent.

Test plan

• Rebuild contact-extractor image in Kind cluster
• Send a contact extraction request and verify no AttributeError
• Verify agent card endpoint still works

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[cwiklik]

Review Summary

The code changes are solid — upgrading marvin to >=3.2.0 for pydantic-ai compatibility, pinning CVE-affected indirect deps (fastmcp>=3.2.0, anthropic>=0.87.0, aiohttp>=3.13.4), and configuring dependabot to avoid risky auto-upgrades. All 3 commits signed-off with proper Assisted-By trailer. All 11 CI checks passing.

Areas reviewed: Python (deps), YAML (dependabot), Security (CVEs), Commit conventions
Commits: 3 commits, all signed-off: ✅
CI status: all 11 checks passing ✅

Must-fix

PR title and description are stale and contradict the actual changes:

• Title says fix: pin marvin<3.1.0 to fix contact-extractor crash — but the actual constraint is marvin>=3.2.0
• Body says marvin 3.1.1 → 3.0.6 — but the lockfile shows marvin 3.1.1 → 3.2.7
• Body says Pin marvin>=3.0.0,<3.1.0 — but pyproject.toml shows marvin>=3.2.0

The PR title becomes permanent git history (squash/merge commit). Please update to match the actual change, e.g.:

• Title: fix: upgrade marvin>=3.2.0 to fix contact-extractor crash
• Body: Update the summary bullets and uv.lock line to reflect the upgrade

Highlights

• Good approach pinning CVE-affected indirect deps as direct constraints with clear comments
• Smart dependabot ignore for marvin major bumps given the pydantic-ai compatibility sensitivity
• Clean commit structure — each commit addresses a distinct concern (marvin fix, CVE bumps, dependabot config)