🧰 Modernize project tooling, CI, and documentation

[frenck]

Proposed Changes

Modernizes the project's tooling, CI, and documentation.

The pyproject.toml has been migrated to the PEP 621 [project] table with Poetry v2, using poetry-core>=2.0, dynamic = ["dependencies"], and requires-poetry = '>=2.0'. Type checking has moved from mypy to ty, with the configuration, dev dependency, pre-commit hook, and CI workflow all updated accordingly. The pre-commit runner is now prek
instead of pre-commit, and a new zizmor hook and CI job have been added to audit GitHub Actions workflows for common security issues.

Python 3.14 is now a first-class target: it has been added to the classifiers, the CI test matrix, and the devcontainer. The devcontainer itself has been switched to a base:ubuntu image with the Python 3.14 feature, and its updateContentCommand now runs prek install.

All CI workflows have been SHA-pinned for third-party actions, madecredential-less via persist-credentials: false, and given job-scoped permissions. New dependency-review and scorecard workflows have been introduced alongside a workflow-level requirements.txt. The sigstore signing step has been dropped from release, the SonarCloud step has been dropped from tests, and the stale.yaml and codeql.yaml workflows have been removed in favor of the scorecard-based approach.

Community files have been refreshed: a SECURITY.md has been added, the old ISSUE_TEMPLATE.md has been converted into a proper ISSUE_TEMPLATE/ directory, the Code of Conduct has been bumped to Contributor Covenant v3.0, dependabot.yml has been removed in favor of Renovate-only, and Renovate itself now extends helpers:pinGitHubActionDigests. As part of the cleanup, sonar-project.properties and a duplicate .github/LICENSE.md have
been removed, .gitignore has been updated to drop .mypy_cache and .ruff_cache and add .ty/, and copyright years have been bumped to 2026.

On the source side, from attr import dataclass has been replaced with stdlib dataclasses.dataclass, removing reliance on an undeclared transitive attrs dependency, and a ruff UP041 finding has been fixed (asyncio.TimeoutError → TimeoutError). The README has also received some overdue love: a typo in the usage example has been corrected (pickup → pickups), pre-commit references have been replaced with prek, the stale SonarCloud badge has been removed, and the minimum NodeJS version has been bumped to 24+.