fix(rest/python): bound ucp-sdk below 0.5 until the server targets v2026-08-25

[vishkaty]

What

One line: rest/python/server/pyproject.toml declares "ucp-sdk" with no bound; this change bounds it to ">=0.4.6,<0.5" so fresh resolutions stay on the 0.4.x line this server is generated against. The bound lifts when the server migrates to spec v2026-08-25.

Why

The server implements UCP 2026-04-08. ucp-sdk 0.5.0, published 2026-08-27T16:10Z, regenerates the models for spec v2026-08-25 and relocates the payment schemas out of shopping/, so a fresh clone now fails at import time: ModuleNotFoundError for ucp_sdk.models.schemas.shopping.payment_create_request via generated_routes/ucp_routes.py, and test collection stops with 3 errors.

Testing

Fresh clone at main (00333a8):

• Unbounded, uv sync resolves 0.5.0: import server fails with the ModuleNotFoundError above.
• With the bound, uv sync resolves 0.4.6: the server imports, all 245 tests collect, and simple_happy_path_client.py completes the full discovery through completion flow against a booted server.
• Pinned pre-commit on the changed file: all hooks pass.

Fixes #221.

[vishkaty]

Flagging that main still carries the unbounded ucp-sdk requirement, so a fresh uv sync resolves 0.5.0 and the Python server fails to import, which is #221. This one line restores a working sync while the server still targets 2026-04-08.

[vishkaty]

Evidence that this change is what lets the reference server start again.

Measured 2026-09-03 by replicating the conformance workflow locally with fresh
clones of conformance fdbdafd, samples 00333a8 and python-sdk.

Without this change the server environment resolves ucp-sdk 0.5.0 and server.py
exits at import with ModuleNotFoundError on
ucp_sdk.models.schemas.shopping.payment_create_request, so the health check gets
no response at all. With this change applied verbatim the environment resolves
0.4.6, the server starts, and /.well-known/ucp returns 200. Boot took 15.5
seconds against the 30 second wait the conformance workflow allows.

For completeness rather than as a claim for this PR: the scheduled Conformance
Tests run has more than one cause, so this change alone does not turn it green.
The conformance suite separately imports the same moved module paths, and its
checkout fixture builds a ShippingDestination where the request union expects
ShippingDestinationCreateRequest, which still reproduces with every component
pinned to 0.4.6.