Drop Python 3.9 support

[mpounsett]

Summary

• raise the package minimum from Python 3.9 to Python 3.10
• remove Python 3.9 from the CI and tox matrices and package classifiers
• require a patched pytest 9 release without Python-version markers
• regenerate uv.lock without Python 3.9 compatibility forks
• update the README and contributor instructions to match the support policy

This removes the only dependency branch that could not receive the pytest
temporary-directory security fix and allows Dependabot's uv updater to resolve
the lockfile normally.

Related issue

Relates to failed Dependabot updates #1470503404, #1470560516, and
#1470608209.

Testing

• uv lock --check
• reproduced Dependabot's previously failing pytest==9.0.3 resolution
• tox test matrix on Python 3.10 through 3.13 (140 passed, 1 skipped each)
• Ruff critical checks
• Bandit baseline check
• pip-audit (no known vulnerabilities)
• Sphinx documentation build with warnings treated as errors
• YAML syntax validation for the revised CI workflow

Compatibility and security

This deliberately drops Python 3.9 support under the project's support policy.
Package runtime behavior and dependencies are otherwise unchanged. The test
environment now resolves only patched pytest 9 releases.

Checklist

• I have read and followed the contribution guide
• Tests were added or updated where appropriate
• Documentation and history were updated where appropriate
• The PR title clearly describes the change