fix(deps): widen workflow anyio pin to >=4.9,<4.14

[LukasGold]

Widens the workflow extra's anyio constraint from >=4.4.0,<4.7 to >=4.9,<4.14.

Closes #139

Changes

• pyproject.toml: workflow extra now pins anyio>=4.9,<4.14; the explanatory comment records the actual break point instead of the previous conservative guess
• uv.lock: anyio 4.6.2.post1 -> 4.13.0; prefect stays at 2.20.25

Rationale

The old <4.7 cap was seven minor releases tighter than necessary. Bisecting prefect==2.20.25 against every anyio minor (py3.12, exercising prefect's own gather()):

anyio	GatherTaskGroup.__abstractmethods__	result
4.6.2, 4.7.0, 4.9.0, 4.10.0, 4.11.0, 4.12.0, 4.13.0	[]	works
4.14.0, 4.14.2 (latest)	['create_task']	TypeError: Can't instantiate abstract class GatherTaskGroup

anyio 4.14.0 added create_task() to the TaskGroup ABC and changed start_soon() to return a TaskHandle (agronholm/anyio#1098). That promoted create_task into the abstract set, breaking prefect's external subclass. Not reverted in 4.14.1 or 4.14.2, and prefect 2.20.25 is the final 2.x release, so no backport is coming - hence the cap stays, just at the correct value.

The >=4.9 floor is what matters for #139: mcp 2.1.1 requires anyio>=4.9 (its stricter >=4.10 clause is gated on python_version >= '3.14', and this project is requires-python = ">=3.10,<3.14", so it never applies). >=4.9,<4.14 therefore satisfies the workflow and mcp extras simultaneously:

prefect 2.20.25 + mcp 2.1.1 + anyio 4.13.0  ->  both import, GatherTaskGroup concrete

No prefect 3.x migration and no source changes are needed.

Verification

• uv lock and uv sync succeed
• full default suite: 36 passed, 1 skipped
• workflow tests pass: test_notify_teams, test_tags_str_to_list, test_deploy_serve. test_deploy_runner is skipped by a pre-existing unconditional "Not deployable in test environment" marker

Follow-up

Not in this PR, since these live on feat/mcp-server. Once this lands, five of the six workarounds from #133 can be reverted:

1. [tool.uv] conflicts (mcp vs workflow, mcp vs dev)
2. mcp excluded from the all extra
3. dev listing prefect/anyio directly instead of osw[workflow], which requires keeping two copies of the pins in sync by hand
4. the separate test group, split out only because dev conflicted with the mcp extra
5. the importorskip guards in the MCP tests

The sixth (ty exclude for src/osw/mcp) is already undone on that branch. Reverting these puts the MCP module back under type checking and unit testing in the default uv sync environment.

[github-actions]

Release preview

Merging this PR would release v2.0.1 (current: v2.0.0).

Changelog preview (truncated)

## v2.0.1 (2026-08-28)

### Bug Fixes

- **deps**: Widen workflow anyio pin to >=4.9,<4.14
  ([`21c4043`](https://github.com/OpenSemanticLab/osw-python/commit/21c4043a168379de43a7fe8ccabd1c266fe1a656))

### Documentation

- Add citation and authorship section to CONTRIBUTING.md
  ([`a3a8119`](https://github.com/OpenSemanticLab/osw-python/commit/a3a8119cd047cee741812b11e3f1f26c3f91c639))

_{Preview via python-semantic-release and conventional commits.}