fix: remediate vulnerable Python dependency floor

[jason-allen-oneal]

What changed

• require Python 3.10 or newer across package metadata, Ruff, and CI
• raise the minimum supported versions to Pillow 12.3, python-dotenv 1.2.2, and pytest 9.0.3
• regenerate the frozen uv.lock graph so the vulnerable Python 3.9 fallback packages are absent
• document the compatibility change

Root cause

This remediation is pinned to default-branch commit 7a47b9f06ed50dffca06dbfa2c69060e95392109.

All 20 open Dependabot alerts collapse to three Python 3.9 lockfile fallbacks:

• alerts ci(security): add daily Codex Security scan #1, ci: repin hardened Codex Security scan #3, and fix: harden audit evidence and evaluation #5-#20: Pillow 11.3.0 (18 advisories)
• alert fix: confine media and sanitize reports #4: python-dotenv 1.2.1
• alert ci(security): harden daily Codex scan #2: pytest 8.4.2

The minimum fixed releases reported by GitHub require Python 3.10 or newer, while the project still declared Python 3.9 support. Raising both the project floor and the dependency floors removes the root cause instead of updating only the current environment.

Compatibility

Python 3.9 is no longer supported. Python 3.10, 3.11, and 3.13 remain in the CI matrix.

Validation

• frozen pip-audit 2.10.1 audit of the exported lock graph on Python 3.10, 3.11, and 3.13: 0 known vulnerabilities
• uv sync --locked --all-extras: passed on Python 3.10, 3.11, and 3.13
• ruff check .: passed on all three interpreters
• full test suite: 70 passed with 88.35% coverage on all three interpreters
• package build and wheel-content verification: passed
• wheel metadata confirms Requires-Python: >=3.10 and the patched dependency floors
• redacted full-history TruffleHog scan: no verified secrets; one unverified URI heuristic was confined to an intentional sanitizer test

Scorecard alerts

Scorecard alert #7 (VulnerabilitiesID) reports the same vulnerable Python 3.9 lock entries and is addressed by this dependency graph change.

The four remaining open Scorecard SARIF alerts are not dismissed or hidden by this PR:

• Maintained: repository age is under 90 days
• Code-Review: historic ratio is 1/28 approved changesets even though main now requires one approving review
• CII-Best-Practices: requires external badge registration
• Fuzzing: requires a detector-recognized OSS-Fuzz/ClusterFuzzLite integration; the current official action path expands CI and mutable-container supply-chain scope and should be reviewed separately

[morrow-bluedot]

Independent exact-head review at 03fbbb8: the Python 3.10 floor and frozen lock remove all 20 vulnerable fallback entries. Audits are clean, 70 tests pass across supported interpreters, package metadata is coherent, and every hosted CI/CodeQL check succeeds.