Bump crewai to >=1.14.4 for parity + security backports (ar-r82f.11)

[atc964]

Summary

Bump the crewai pin from ==1.10.1 to >=1.14.4,<2.0.0 to absorb four upstream CVE backports and align with the seller-agent bump landing in parallel (sibling bead ar-r82f.12).

CVE backports absorbed

• Path traversal in tool sandbox file resolution
• SSRF in URL-fetching tools
• SSTI in litellm template handling
• transformers CVE (pinned transitively)

Crewai 1.14 fallout

Crewai 1.14 turned Flow into a Pydantic model and removed the legacy state setter. DealBookingFlow.__init__ previously did super().__init__(**state_kwargs), which 1.14 silently drops because those kwargs aren't Flow fields. The fix wraps state kwargs in a typed BookingState(**kwargs) and passes it through Flow's new initial_state= field — preserving the existing DealBookingFlow(client, campaign_brief=...) call sites in the API and CLI. The pre-existing TestCrewAI110FlowStateRegression suite covers this contract.

Pre-bump greps (clean)

grep -rn "CodeInterpreterTool"  src/ tests/   # 0 hits
grep -rn "CrewAgentExecutor"    src/ tests/   # 0 hits
grep -rn "EXASearchTool\b"      src/ tests/   # 0 hits (rename to ExaSearchTool is not relevant)

Local test results

• uv lock: resolved 185 packages, crewai resolves to 1.14.6
• uv sync --extra dev: ok
• uv run pytest tests/ -q: 3225 passed, 58 skipped, 0 failed in 225s
• Delta vs main baseline (post-Skip cross-repo integration test when sibling repos absent (ar-r82f.6) #92, 3222 passed / 60 skipped): +3 new passes (the three previously failing TestCrewAI110FlowStateRegression regression tests now exercise the bumped Flow), 2 fewer skips (entry collection deltas), 0 new failures.
• Ruff lint failures (~479) are pre-existing on main — unchanged by this PR.

Test plan

• CI Test job passes on fix/bump-crewai-buyer
• CI Docker build job passes
• Verify no regressions vs the post-Skip cross-repo integration test when sibling repos absent (ar-r82f.6) #92 baseline (3222 passed / 0 failed)

🤖 Generated with Claude Code