fix: require secure AnyIO and pytest versions

[davidhu2000]

Require AnyIO 4.14.2+ to address TLS certificate spoofing and process-worker denial of service (GHSA-82r6-8w77-94w6, GHSA-5p39-cfhj-2xmp), and pytest 9.0.3+ to address unsafe temporary-directory handling (GHSA-6w46-j5rx-g56g). Update pytest-asyncio for compatibility and refresh the Poetry lockfile.

These patched dependencies require Python 3.10+, so raise the SDK minimum from 3.8 to 3.10 and align the publishing workflow and installation documentation. This drops support for Python 3.8/3.9; the CI matrix already starts at 3.10.

Proof: all 80 existing tests pass on Python 3.10, mypy passes for 241 source files, helper parameter sync passes, and pip-audit reports zero known vulnerabilities in the locked dependencies. The lockfile remains in Poetry 1.8-compatible format 2.0.