chore(deps): bump httpx>=0.28.1 and anthropic>=0.40.0

[ngoclam9415]

Why

httpx<0.28 blocked dana-agent[langsmith]'s websockets>=15 requirement in a single uv workspace — the resolver could not satisfy both. anthropic==0.30.1 caps httpx<0.28, so httpx and anthropic must move together: bumping one without the other breaks resolution and imports.

Changes

Dep	Before	After	Resolved
httpx	>=0.27.0,<0.28.0	>=0.28.1	0.28.1
anthropic	==0.30.1	>=0.40.0	0.116.0
llama-stack	>=0.3.0	>=0.3.0; python_version>='3.12'	marker-gated
requires-python	>=3.12	>=3.11,<3.14	widened

• anthropic>=0.40.0 is the first release supporting httpx 0.28.x. The API surface dana uses (AsyncAnthropic, messages.create/stream, content/usage blocks, APITimeoutError/BadRequestError) is stable 0.30 → 0.116, so the bump is API-safe.
• llama-stack requires Python ≥3.12; the marker keeps [local] resolvable on 3.11 (ollama-only) while the lockfile now spans 3.11–3.13.

Note: httpx>0.28.1 is unsatisfiable — 0.28.1 is the latest published release, so the constraint is >=0.28.1.

Validation

• Live OpenAI provider test passes on httpx 0.28.1 (real API round-trip).
• anthropic 0.116.0 makes real HTTP round-trips — SDK + httpx transport confirmed working. (Live Anthropic 200 blocked only by an expired gateway key in local .env; not a code issue.)
• Unit tests: no new regressions. 3 pre-existing TestOpenAIReasoningTokens failures are unrelated (Responses-API code/test drift, fix already on develop as 1c22655).