chore: float launchdarkly-server-sdk within its current major

[devin-ai-integration]

Summary

Bounds the SDK dependency to the 9.x major so poetry install keeps picking up the latest 9.x release but can't silently jump to a future 10.0.0 with breaking changes.

• launchdarkly-server-sdk = ">=9.16.0" → ">=9.16.0,<10.0.0"; floor unchanged, still resolves to 9.17.0.
• halo = ">=0.0.3" left alone: 0.x minors are breaking, so a <1.0.0 cap isn't the right idiom here.
• python = "^3.10" and the README's documented "Python 3.10 or higher" minimum untouched (SDK 9.17.0 still requires >=3.10).
• No deprecated SDK APIs in use; no other changes needed.

Implementation details

Verification on this branch (Python 3.12, Poetry 2.5.1):

• poetry install resolves launchdarkly-server-sdk 9.17.0 (latest 9.x) + launchdarkly-eventsource 1.7.3, halo 0.0.31; poetry.lock is gitignored, so nothing to regenerate in-tree.
• Ran the example before and after the change with the shared hello-app server key and LAUNCHDARKLY_FLAG_KEY=hello-boolean:
  • CI=1 poetry run python -W error::DeprecationWarning main.py → *** SDK successfully initialized / *** The hello-boolean feature flag evaluates to True + banner, exit 0.
  • Watch-loop path (no CI) also initializes and evaluates; the only deprecation surfaced is upstream halo/halo.py:497 setDaemon() is deprecated, not our code.
• Deprecation audit: the only DeprecationWarning in ldclient 9.17.0 is Config.copy_with_new_sdk_key, which the example does not use. set_config, ldclient.get(), variation, flag_tracker.add_flag_value_change_listener, and Context.builder are all current.
• Alternatives rejected: leaving >=9.16.0 unbounded (contradicts the float-within-major policy); ^9.16.0 (equivalent for 9.x but the repo already uses >=-style constraints); raising the floor to 9.17.0 (unnecessary — the constraint already permits latest).
• GitHub Actions pins (checkout@v7, setup-python@v7.0.0, abatilo/actions-poetry@3765cf6, verify-hello-app-v2.0.1) are all already latest and deliberately pinned; untouched.

Link to Devin session: https://app.devin.ai/sessions/060a05cf5a56488ca7025fc0cdfd433f
Open in Devin Desktop: https://app.devin.ai/desktop/session/060a05cf5a56488ca7025fc0cdfd433f?variant=devin

---

Note

Overview
Caps launchdarkly-server-sdk in pyproject.toml so Poetry still accepts 9.16.0+ but won't resolve a future 10.x release. The minimum version is unchanged; installs continue to float within the current major (e.g. 9.17.0).

No application or CI workflow changes—only the dependency constraint.

^{Reviewed by Cursor Bugbot for commit 50fe83f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review