fix(deps): close Dependabot alerts (aiohttp, anyio, idna, pytest); require Python 3.10

[devin-ai-integration]

Summary

This PR fixes all 36 open Dependabot alerts in this repo (1 critical, 2 high, 16 medium, 17 low). They are the Vanta "vulnerabilities in packages are addressed (GitHub Repo)" findings for this repo.

Changes to uv.lock:

• aiohttp 3.13.2 → 3.14.4 (fix needs ≥ 3.14.3)
• anyio 4.11.0 → 4.15.1 (the critical alert; fix needs ≥ 4.14.2)
• idna 3.11 → 3.20 (fix needs ≥ 3.15)
• pytest 8.4.2 → 9.1.1 (dev only; fix needs ≥ 9.0.3)

Transitive bumps: yarl, typing-extensions, and others when the 3.9 fork is gone.

Breaking change: requires-python goes from >=3.9 to >=3.10. This applies to reductoai and to the reducto shim. The same change goes into .python-version, pyright pythonVersion, the classifiers, and the README. Every fixed version above requires Python ≥ 3.10. Under >=3.9, uv keeps a separate python_full_version < '3.10' fork in the lockfile, and that fork stays on the vulnerable versions, so Dependabot keeps those alerts open. Python 3.9 reached EOL in Oct 2025. Release this as a minor version bump with a changelog note.

Runtime floors in dependencies do not change (anyio>=3.5.0 and others). User installs still resolve freely.

Supersedes draft #106, which was written before the move to uv.

Verification

• ./scripts/lint (ruff, pyright, mypy): clean
• ./scripts/test: 453 passed (pydantic v2), 450 passed (pydantic v1). The skips are pre-existing mock-server tests.
• uv build: OK
• pip-audit on uv export --all-extras --all-groups: "No known vulnerabilities found"

Link to Devin session: https://app.devin.ai/sessions/3bac4fe0b8704262961cb52d51f4e3ec
Open in Devin Desktop: https://app.devin.ai/desktop/session/3bac4fe0b8704262961cb52d51f4e3ec?variant=devin
Requested by: @raunakdoesdev

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Raunak

Reducto is remediating failing Vanta HIPAA + SOC 2 tests by Fri Oct 9, 2026 (requested by Raunak, CTO). These tests fail in Vanta (app.vanta.com/c/reducto.ai/tests):

• High vulnerabilities identified in packages are addressed (GitHub Repo) [HIPAA, SOC 2] — Vanta test id 6abae573b6ace0839c607a9d; failing: Overdue; 5 Github Vulnerabilities failing entities; due 2 quarters ago; Vanta owner: Unassigned. Suggested remediation: Map failing packages/images to deployed workloads; inspect advisories; patch dependencies or base images in the owning repository; rebuild and scan; deliver reviewed PRs. Do not delete images or dismiss findings to make the test pass. Counts are vulnerability findings, not unique exploitable flaws.
• Medium vulnerabilities identified in packages are addressed (GitHub Repo) [HIPAA, SOC 2] — Vanta test id 6abae573e2ea5c2761682bad; failing: Overdue; 21 Github Vulnerabilities failing entities; due 2 quarters ago; Vanta owner: Unassigned. Suggested remediation: Map failing packages/images to deployed workloads; inspect advisories; patch dependencies or base images in the owning repository; rebuild and scan; deliver reviewed PRs. Do not delete images or dismiss findings to make the test pass. Counts are vulnerability findings, not unique exploitable flaws.
• Low vulnerabilities identified in packages are addressed (GitHub Repo) [HIPAA, SOC 2] — Vanta test id 6abae572bc270c8da22903e0; failing: Overdue; 14 Github Vulnerabilities failing entities; due 3 months ago; Vanta owner: Unassigned. Suggested remediation: Map failing packages/images to deployed workloads; inspect advisories; patch dependencies or base images in the owning repository; rebuild and scan; deliver reviewed PRs. Do not delete images or dismiss findings to make the test pass. Counts are vulnerability findings, not unique exploitable flaws.
• Critical vulnerabilities identified in packages are addressed (GitHub Repo) [HIPAA, SOC 2] — Vanta test id 6aae56ab41d134a69890467d; failing: Due soon;... (1439 chars truncated...)