ci: test the supported Python range, and gate ruff and mypy

[rohan-hotdata]

Closes #42.

CI ran pytest on Python 3.12 alone while requires-python claimed >=3.10, so neither end of the supported range was exercised. Ruff and mypy were configured and installed but never run, so lint and type regressions could land on main freely.

What changed

A matrix over 3.10–3.14, with fail-fast: false so one version failing does not mask the others. I ran all five locally before writing a workflow that asserts they pass: the suite is green on every one. test_the_agents_extra_provides_the_package_create_agent_lives_in skips on 3.10, where tomllib is not in the standard library — it still runs on 3.11 and up, so the claim it guards stays covered, and a tomli dependency for one test did not seem worth it.

A second job gating ruff check, ruff format --check, and mypy. Ruff was already clean on main. Mypy was not, and getting there is the bulk of this diff.

The mypy baseline was 54, not the 18 the issue records

The issue's figure was measured a while ago and the shape had drifted too. 49 were no-untyped-def as described — missing annotations on test functions and their fixture parameters. Five were not, and those are the ones worth reviewing:

• spec_from_file_location returns ModuleSpec | None, and tests/test_update_changelog.py narrowed it after passing it to module_from_spec. The assert was one line too late.
• FakeOpener.requests was typed list[object], which makes .headers unreachable on the Request the fetch actually appends. The annotation was describing the double inaccurately.
• update_changelog_text comes off a dynamically loaded module and so is Any; it is now bound to a declared str on the way out.
• vector_distance_sql is passed an invalid metric on purpose in test_search.py, so that one call carries a scoped # type: ignore[arg-type]. warn_unused_ignores is on, so it will be flagged if it ever stops being needed.

Package source was already clean, as the issue said.

The 49 annotations were generated mechanically and then read through as a diff. Under from __future__ import annotations a wrong annotation cannot fail a test — it can only mislead the next reader — so the diff review is the check, not the suite. ruff format reflowed the fifteen signatures that went over 100 characters.

Two things checked rather than assumed

The status-check rename. Test (Python 3.12) becomes a matrix, which would break a ruleset requiring that exact name. Neither the branch-protection API nor the three org rulesets on this repo pin any status check by name, so the rename does not strand a required check.

Docs. The audit found one claim this change made stale: README's Development section listed uv sync --locked and uv run pytest, which is now an incomplete recipe — someone following it gets a red build on lint or types without knowing why. It now lists the three gating commands too. CHANGELOG has an entry under [Unreleased].

Verification

ruff check clean, ruff format --check clean, mypy 54 errors to 0, 575 tests passing on 3.11–3.14 and 574 plus one skip on 3.10.