ci: qualify CPython 3.14 and bound interpreter support

[doublewhy]

Plain-language summary

• Context: OpenRAE publishes a Python package and needs an explicit, tested interpreter range.
• Problem: Package metadata admitted untested future Python versions, normal CI exercised only Python 3.12, and the MCP tests used event-loop behavior removed in Python 3.14.
• Fix: Qualify standard CPython 3.11–3.14 end to end, preview free-threaded 3.14 separately, reject Python 3.15 for now, and harden the compatibility runner.

Issues closed

Closes #1097

Closes #1117

Closes #1100

• ci: qualify CPython 3.14 and bound interpreter support #1097: bounds Requires-Python to >=3.11,<3.15; aligns classifiers; adds an exact-runtime 3.11–3.14 CI matrix; runs frozen tests, distribution builds, clean wheel installation, metadata/import checks, and CLI smoke tests; and adds a nonblocking 3.14t preview.
• [BUG] MCP tests rely on removed implicit event-loop behavior on Python 3.14 #1117: replaces implicit-loop MCP test calls with asyncio.run(...) and verifies the module with event-loop deprecations promoted to errors.
• fix: reject missing nox policy option values cleanly #1100: routes both policy argument parsers through one guarded option-value reader and tests missing, empty, and option-in-value-position failures.

This is the complete successor to the partial work in #1087 and #1089. It does not edit or close either earlier PR.

Support boundary

• Supported standard interpreters: CPython 3.11, 3.12, 3.13, and 3.14.
• Preview signal only: free-threaded CPython 3.14 (3.14t), scheduled/manual and continue-on-error.
• Not admitted: Python 3.15. A separate post-final dependency and wheel qualification is required before raising the upper bound.

The standard matrix is blocking within the CI workflow: its jobs do not use continue-on-error. Adding its dynamic matrix contexts to protected-branch required checks is an administrator setting outside this PR; this PR does not claim that setting is already configured.

The compatibility session fails closed unless the selected runtime matches the named CPython feature release and threading mode. It restores the matrix selector into Nox's command environment, performs a frozen all-extras sync, runs the hermetic suite, builds one wheel and one source distribution, installs the wheel into a new environment, checks installed Requires-Python, imports every public package, and smokes raes --version plus raes --help.

The MCP dependency remains on the qualified 1.x API line (>=1.28.1,<2) so an unreviewed future major release cannot silently invalidate this compatibility result.

Verification

The branch was merged with dev at 944b4617, retaining the merged #1129 CLI traceability and this PR's #1097/#1100/#1117 traceability. The merged head also combines #1130's Python 3.11.4 OCI extraction floor, #1143's branch-aware coverage policy, and this PR's standard CPython 3.11-3.14 and below-3.15 support boundary.

Local results across the two rebases, with the affected suite, MCP checks, Ruff, and policy graph rerun after the final README resolution:

• Final 3e26db12 head, standard CPython 3.14 affected focused suite: 261 passed and 1 deselected.
• Immediately preceding rebased head, standard CPython 3.11, 3.12, 3.13, and 3.14 plus free-threaded 3.14 focused matrix: 261 passed and 1 deselected per interpreter.
• Immediately preceding rebased head, full standard CPython 3.14 compatibility session: 6,608 passed and 1 skipped; exact-runtime assertion, wheel/sdist build, clean install, metadata/import validation, and installed CLI smoke all passed.
• MCP deprecation-to-error regression: 85 passed.
• Final local docs graph passed Vale with zero findings, executable quickstart tests, warning-as-error Sphinx HTML, and output inventory validation.
• Ruff 0.15.9 check and formatting validation passed for all changed Python/tooling files.
• Repository policy, requirement-diff policy, semantic/assurance/authority/deprecation governance, and ADR immutability checks passed. The optional remote Ground Control requirement lookup was unavailable due local DNS and was skipped by its existing offline policy.

Earlier isolated Ubuntu 24.04 qualification established the complete cross-version path before this rebase:

Runtime	Exact build	Hermetic suite	Build/install/import/CLI
CPython 3.11	3.11.15	6,426 passed, 1 skipped	passed
CPython 3.12	3.12.3	6,426 passed, 1 skipped	passed
CPython 3.13	3.13.14	6,426 passed, 1 skipped	passed
CPython 3.14	3.14.6, GIL enabled	6,426 passed, 1 skipped	passed
CPython 3.14t	3.14.6, GIL disabled	6,426 passed, 1 skipped	passed

The updated exact head eabc4b0052b0c03162a7151330f7bd752f0728bd, merged with dev at 944b4617, passed hosted verification: canonical verification passed in 10m14s; the required CPython 3.11, 3.12, 3.13, and 3.14 compatibility jobs passed; Sonar passed in 2m20s; and CodeQL, docs, fuzz, supply-chain, container integration, GitGuardian, and title policy passed.

Scope boundary

No SDL, contract, runtime, evaluator, solver, or backend semantics change. No Python 3.15 production or preview claim is introduced.

[Brad-Edwards]

Updated the branch to current dev and completed the verification-policy integration:

• Merged dev at 944b4617; the test-file conflict was resolved by retaining both the Python-compatibility tests and the branch-aware coverage tests.
• Amended and re-pinned ADR-014 to define the supported-interpreter matrix as a required CI extension to the single-interpreter verify gate. The historical-identity digest was refreshed because it content-binds the ADR index.
• Added the CPython 3.11, 3.12, 3.13, and 3.14 compatibility checks to branch protection for both dev and main.
• Local completion verification passed: 6,935 unit tests, 59 integration tests, contracts, policy, Ruff, proof replay, documentation, and combined coverage.
• Hosted verification passed on eabc4b00: all four required interpreter jobs, canonical verify, Sonar, CodeQL, documentation, fuzz, supply-chain, container integration, GitGuardian, and title policy.