Update plugin dependencies: decart 0.0.29, turbopuffer <1.20, lockfile bumps

[cursor]

Weekly automated dependency update.

Plugin constraint changes:

• decart: ==0.0.8 → ==0.0.29 — API migration: enrich → enhance, mirror removed from ModelState
• turbopuffer: >=1.17.0,<1.18 → >=1.17.0,<1.20 — non-breaking minor releases (MCP support, branching, perf)

Lockfile-only upgrades (within existing constraints):

• boto3 1.42.74 → 1.42.75
• fal-client 0.13.1 → 0.13.2
• twilio 9.10.3 → 9.10.4
• xai-sdk 1.9.1 → 1.10.0
• anyio 4.12.1 → 4.13.0
• redis 7.3.0 → 7.4.0
• langchain-core 1.2.21 → 1.2.22

Not updated (known constraints):

• rfdetr 1.6.0 requires transformers>=5.1.0 (conflicts with smart_turn/moondream <5)
• inference-sdk 1.1.2 requires pillow>=11.0 (conflicts with moondream <11)
• mistralai 2.x removes Mistral class (breaking); pinned <2
• huggingface_hub capped at <1.0
• websockets 16.0 blocked by xai plugin <16