ci: reconcile service Python runtime metadata and executable compatibility

[seonghobae]

Problem

Fresh dependency-closure review invalidated this issue's original premise that Python 3.11 is a truthful supported service runtime. Both Orgmetra HTTP services on protected develop advertise requires-python = ">=3.11", but both mandatory owned runtime dependencies currently require Python 3.12 or newer:

• packages/hris-kernel/pyproject.toml: requires-python = ">=3.12"
• packages/keyverse-adapter/pyproject.toml: requires-python = ">=3.12"
• services/job-analysis-api/pyproject.toml: requires-python = ">=3.11" and requires both packages
• services/people-api/pyproject.toml: protected truth still advertises >=3.11; canonical People owner fix(people): protect governed mutation runtime types #64 now carries the ordinary repair to >=3.12

That means the service distributions cannot be installed with their mandatory owned dependency closure on Python 3.11. A source-tree PYTHONPATH test can hide this contradiction because it bypasses dependency resolution. Treating the advertised lower bound as proof of support would preserve false metadata rather than compatibility.

Owner order

Do not lower package runtime floors merely to preserve the earlier issue wording, and do not copy mutable #64/#259 source. #259/#258 first establish protected package-neutral Foundation compatibility ownership. #64 then integrates the People metadata correction through its canonical owner. From fresh protected truth, this lane reconciles the remaining service contract, including Job Analysis, and adds repository-level fail-closed evidence.

Acceptance

• Discover owned service pyproject.toml metadata without a service-name switchboard where practical.
• Resolve each mandatory Orgmetra-owned distribution dependency to its canonical package metadata and fail when a service Python floor is lower than any mandatory dependency floor.
• Correct impossible advertised service floors to the effective installable dependency closure unless a package owner separately demonstrates, with executable tests, that its own lower floor can safely be reduced.
• For the current dependency closure, treat Python 3.12 as the minimum truthful service floor; do not claim Python 3.11 support without complete installed-artifact evidence for every mandatory dependency.
• Execute each truthfully declared service runtime covered by the canonical compatibility policy using actual interpreter patches and each service's own pytest configuration with exact 100% statement/branch coverage.
• Preserve ubuntu-24.04, one canonical Foundation quality job, hash-locked immutable tooling, exact-head checkout, fail-closed metadata parsing, non-vacuous execution, and retired service-workflow non-resurrection.
• Integrate with ci: replace source-tree PYTHONPATH acceptance with installed-wheel contracts #261's installed-wheel acceptance so runtime support is proved against the built dependency closure rather than repository PYTHONPATH source injection.
• Add executable regressions for dependency-version and dependency-runtime-floor contradictions; reseal tracked provenance from final bytes and acquire fresh exact-head Foundation/SAST/Security/CodeQL/review evidence before protected integration.

This supersedes the earlier instruction to preserve Python 3.11 merely because the service metadata advertised it. Unsupported metadata is a defect to correct, not an acceptance target.