ci(renovate): constrain updates to supported Python

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: emyller

renovate.json5

@@ -8,6 +8,13 @@
   // `fix`/`chore`; ignore it so we keep `deps:` as the commit prefix.
   ignorePresets: [':semanticPrefixFixDepsChoreOthers'],
   semanticCommitType: 'deps',
+  // `constraintsFiltering: strict` makes Renovate skip any release whose
+  // `requires-python` excludes a Python version we support, so a security
+  // bump can't target an unsupported one.
+  constraints: {
+    python: '>=3.10',
+  },
+  constraintsFiltering: 'strict',
   'git-submodules': {
     enabled: true,
   },