fix(deps): floor cmcp-runtime so an unsatisfiable constraint fails loudly

[imran-siddique]

cmcp-runtime had no version floor, so an unsatisfiable constraint elsewhere in this file resolved as a silent three-version downgrade instead of an error.

What happened

#48 bumps weight-custody-manifest to >=0.25.0. That release requires cryptography>=50,<51. cmcp-runtime 0.4.0 requires agent-governance-toolkit-core>=4.1.0,<5.0, and every agt-core in that range caps cryptography<49.0. The two cannot both be satisfied.

Because cmcp-runtime was completely unpinned, pip did not say so. It backtracked to cmcp-runtime 0.1.0, the only release with no agt-core dependency at all, installed it and cryptography 50.0.0 successfully, and the failure surfaced one step later as:

-- Starting cMCP Runtime (CMCP_DEV_MODE=1) on :8443 --
cMCP Runtime exited with code 1 before listening on :8443.

Install exit code 0. The demo job then failed for what reads like a runtime bug in the gateway.

What this changes

• cmcp-runtime>=0.4.0. The floor is the actual fix. With it, an unsatisfiable set is a resolver error naming the conflicting requirements, at install time, instead of an ancient runtime that starts and dies. That property matters more than this particular bump: any future dependency that caps cryptography low would have produced the same silent downgrade.
• weight-custody-manifest>=0.23.0,<0.25.0. A hold, not a preference. With the floor in place and no ceiling here, the demo simply stops installing. This keeps it working until the cap moves.

Why the ceiling cannot just be dropped

Widening cmcp-runtime's agt-core range does not help: agt-core 5.0.0 moves the cap only to cryptography<50.0, which still excludes the >=50 that weight-custody-manifest 0.25.0 requires. There is no combination available today. The durable fix is upstream, in agt-core allowing cryptography 50, which is what agentrust-io/cmcp#471 is about.

Remove the ceiling and unblock #48 once that lands.

Note on scope

examples is not affected and needs no equivalent change. It carries cmcp-runtime>=0.4.0 in industrial-embodied-ai/requirements.txt and weight-custody-manifest>=0.25.0 in weight-custody-manifest/requirements.txt, which are separate environments and never resolved together. demos resolves everything into one.