Restore Python 3.14 pin via rules_python git_override

[Syndic]

Summary

Flips `python_version` back to `"3.14"` by pinning rules_python to the post-2.0.1 commit (bazel-contrib/rules_python@9dc505b9 from upstream PR #3764) that adds cp314 to the bundled `coverage` wheel set in `python/private/coverage_deps.bzl`.

Without that fix, `configure_coverage_tool = True` is a silent no-op on Python 3.14 and `bazel coverage` produces empty per-test lcov for py_test targets — which is why we pinned to 3.13 in #56.

How the override is structured

`bazel_dep(name = "rules_python", version = "2.0.1")` is kept as-is. `git_override(...)` is added on top, pinned to a specific SHA (not a branch), so it doesn't auto-bump.

Renovate's `bazel-module` manager continues to track the `bazel_dep` line. When the first rules_python release containing #3764 lands, Renovate will open a version-bump PR — and that PR is the prompt to:

1. Inspect the release notes / verify `coverage_deps.bzl` includes cp314.
2. Accept the version bump.
3. Remove the `git_override`.

Tradeoffs

• `git_override` runs `git clone` of rules_python at build time, which is slower than a BCR registry fetch and depends on github.com reachability. Acceptable until the next release lands.
• The override is invalid in BCR-published modules; only valid in our root `MODULE.bazel`.

Validation

```
$ bazel coverage //meta/scripts:test_check_secrets_dir
//meta/scripts:test_check_secrets_dir PASSED in 1.3s

$ awk '...py$.../{...}' _coverage_report.dat
meta/scripts/check_secrets_dir.py 9/10 90%
```

`bazel test //...` — all 10 tests pass.

Test plan

• `bazel test //...` passes.
• `bazel coverage //meta/scripts/...` produces non-empty lcov for Python sources on 3.14.
• `docs/future-considerations.md` "Restore Python 3.14 Pin" entry removed.
• CI's `coverage` job confirms Python lcov still uploads to Codecov.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.03%. Comparing base (9fd433b) to head (23edd92).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #66      +/-   ##
==========================================
- Coverage   89.54%   89.03%   -0.51%     
==========================================
  Files          31       31              
  Lines        1511     1505       -6     
  Branches      104       56      -48     
==========================================
- Hits         1353     1340      -13     
+ Misses        155      153       -2     
- Partials        3       12       +9     

Components	Coverage Δ
Go	89.45% <ø> (ø)
Python	86.88% <ø> (-3.12%)	⬇️
Category: apps	∅ <ø> (∅)
Category: infra	∅ <ø> (∅)
Category: libs	∅ <ø> (∅)
Category: meta	86.88% <ø> (-3.12%)	⬇️
Category: services	∅ <ø> (∅)
Category: tools	89.45% <ø> (ø)
Project: meta/scripts	86.88% <ø> (-3.12%)	⬇️
Project: tools/network_infrastructure_maintenance	89.45% <ø> (ø)
see 6 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9fd433b...23edd92. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.