DX: upgrade environment to Python 3.14

[dependabot]

• Closes https://github.com/ComPWA/.github-private/issues/27
• Closes Upgrade developer environment to Python 3.14 policy#704

🖱️ Developer experience

• The developer environment, Binder and the Read the Docs build run on Python 3.14 instead of 3.13 (requires-python = "~=3.14.0"). On this target, Ruff removes the quotes around forward-referenced return annotations in the ADR 002 notebooks.

🔨 Maintenance

• ComPWA/policy is updated to 0.10.0, so the style task runs prek run --all-files and the upgrade task runs prek autoupdate instead of the pre-commit equivalents.
• The cspell hook no longer pins Node 25.9.0.
• Ruff rules are referred to by name instead of by code, both in the configuration and in suppression comments such as # ruff: ignore[magic-value-comparison].
• The link check skips Zenodo DOIs and badges, because zenodo.org responds with 403 Forbidden in CI.
• Agent instruction files such as AGENTS.md, CLAUDE.md, and .claude/ are ignored by Git.
• All GitHub Actions are pinned to release commit SHAs, and the workflows from ComPWA/actions are updated to v4.1.4. The version branch workflow gets contents: write permission instead of inheriting all secrets.

📝 Documentation

• The contributing guide explains how to install the hooks with prek instead of pre-commit.
• The "Open in Visual Studio Code" badge links to github.dev instead of open.vscode.dev, which no longer responds.
• The developer guide installs the tools with Python 3.14.

Squash commit messages

* DOC: document prek in the contributing guide
* DOC: link to github.dev instead of open.vscode.dev
* MAINT: ignore agent instruction files
* MAINT: ignore Zenodo links in link check
* MAINT: pin GitHub Actions to release commits
* MAINT: refer to Ruff rules by name
* MAINT: run `prek` in the style and upgrade tasks
* MAINT: unpin Node version of cspell hook
* MAINT: update ComPWA/policy to 0.10.0