chore: pin workflow tools and supported Python versions

[binaryaaron]

What changed and why

Declare Python >=3.11,<3.15 with a 3.12 default, pin tool selection, and enforce lock consistency. Keep dependency changes limited to the support/tool policy and enable CI for stacked branches.

Stack position: 1/12. Base: main. Merge in stack order.

How it was verified

The unchanged candidate has a strict schema-v3 Arc acceptance and 84 focused tests, with lock/static/documentation checks.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}