fix: restore security dep versions reverted by conductor-clients-alias merge

[nthmost-orkes]

Summary

The feat/conductor-clients-alias PR (#404) accidentally reverted four security fixes from fix/security-dependency-bumps (#382):

Setting	Should be	Was accidentally reverted to
python	>=3.10	>=3.9
requests	>=2.33.0	>=2.31.0
pytest	^9.0.3	^8.4.1
pygments (dev)	>=2.20.0	removed
ruff target-version	py310	py39

This left filelock>=3.20.3 (which requires Python >=3.10) in dev deps while the Python floor was reset to 3.9, making poetry lock unsolvable — which broke the Harness Worker Image build on every push to main.

Also syncs requirements.txt with pyproject.toml main deps: requests >= 2.31.0 → >=2.33.0, loose-pins typing-extensions, adds h2 >= 4.1.0 and the httpx[http2] extra.

---

When did Python 3.9 actually become unsupported?

February 27, 2026 — commit c09ea520 ("Bump vulnerable dependencies") added filelock>=3.20.3 and virtualenv>=20.36.1 as dev deps. filelock>=3.20.3 requires Python >=3.10, so 3.9 became de facto incompatible at that point.

The python = ">=3.10" constraint was only written explicitly in the fix/security-dependency-bumps PR on April 23, 2026, but the effective EOL for 3.9 in this repo dates back ~2 months earlier.

---

User impact: The Docker harness worker image build has been failing on every merge to main since #404 landed. This restores the security settings and regenerates poetry.lock, unblocking CI.

Test plan

• Harness Worker Image workflow passes on this PR or after merge to main
• poetry lock runs without error locally (verified ✓)
• Unit tests pass (CI)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.