Non-blocking review findings from PR #15 (1)

[twistedmelonman]

Non-blocking concerns raised while reviewing PR #15 (deps(plugin-eval): bump anthropic from 0.116.0 to 1.4.0 in /plugins/plugin-eval).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 1 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

• anthropic 1.x major bump swaps the HTTP stack to httpx2/httpcore2 with no source changes in the PR (reviewer-noted context (human comment @dependabot rebase by twistedmelonman; no reviewer explicitly flagged this), plugins/plugin-eval/uv.lock)
  This is a 0.x → 1.x major version bump of the anthropic SDK, and the lockfile shows the transitive dependency set changing materially — distro and httpx are dropped in favor of httpx2, httpcore2, truststore, and httpx2-jsfetch, with idna moving 3.15 → 3.19. No application source is modified in this PR, so any 1.x breaking API changes would only surface at runtime in paths the test suite does not cover. Per the repo's own auto-merge policy, majors are not auto-merged and get human review; suggested action is a quick pass over the anthropic 1.0 migration notes and confirmation that plugin-eval's client-construction and streaming call sites still match the 1.x surface. The passing plugin-eval pytest and real-CLI smoke checks are supporting evidence but not proof of full API coverage.