ci: prove minimum supported Python 3.10 or narrow package metadata

[seonghobae]

Buyer-visible compatibility gap

Protected main declares requires-python = ">=3.10", while the active compatibility line currently exercises the full Python suite on CPython 3.12 and 3.14 only. That closes the CWL Python-3.14 evidence gap once integrated, but the package's minimum advertised runtime still lacks exact protected-main CI evidence.

A commercial package must not imply support solely from metadata. Either prove the declared lower bound or deliberately narrow the metadata through a reviewed compatibility decision.

Exact current evidence

• protected main: a7be9eb8ca0b807364173f8471fc300e3cf9350f;
• pyproject.toml declares requires-python = ">=3.10";
• stale predecessor ci: test supported runtime on Python 3.14 #622 is closed unmerged; no checks/reviews/writer authority transfer from it;
• clean-lineage Draft ci: replace stale Python 3.14 branch on protected-main lineage #689 is the sole active Python-3.14 compatibility implementation, exact head 2f8202d7c7cc6b9f5b3ad5678fe03e13802bae90, based directly on current protected main;
• CI run 31454683734 proves both Python 3.12 and 3.14 lanes install the same hash-locked dependencies, build the Rust/PyO3 extension, resolve the default backend to Rust, and run the same full pytest suite. The Python 3.12 lane completed 1 failed, 2948 passed, 2 skipped, and the only failure is deterministic managed-CHANGELOG.md parity; the 3.14 lane fails at the same managed-release-note gate rather than a Python-3.14 compatibility boundary. Rust, package/reinstall/release-acceptance, explicit GPU, fuzz, Security Scan and SAST are GREEN on this fail-first/current integration;
• an exact bounded OpenCode writer is already assigned to ci: replace stale Python 3.14 branch on protected-main lineage #689 solely for deterministic changelog rendering. Do not race it.

This issue is intentionally not part of #689. Finish and integrate the bounded 3.14 slice first; then address the minimum-runtime contract from the resulting protected head so CI-matrix ownership remains single-writer and predecessor evidence is not reused.

Required decision and TDD acceptance

Choose one evidence-backed path after #689 integrates or its workflow writer lease is explicitly clear.

Preferred: keep >=3.10 and test the lower bound

1. Add a fail-first CI contract proving the full Python job includes CPython 3.10 as the minimum supported runtime.
2. Ensure the 3.10 lane uses the same hash-locked dependency set or a separately governed compatible lock when one lock cannot satisfy all declared runtimes; never silently drop hashes.
3. Build/install the Rust/PyO3 extension, prove the resolved default backend is Rust, and run the same complete pytest suite.
4. Fix any real Python 3.10 syntax/API/dependency incompatibility at the root cause rather than skipping, xfail-ing, or reducing the lane.
5. Preserve Python 3.14 evidence, immutable action pins, package/reinstall, GPU/fuzz/security and release-acceptance gates.
6. Record the tested support matrix in canonical documentation through docs: establish canonical product and architecture baseline #604/docs: close canonical documentation fitness gaps without parallel authority #621 and in authoritative changelog material.

Alternative: narrow support metadata

If Python 3.10 support is no longer commercially intended or dependencies cannot support it without disproportionate maintenance cost, explicitly raise requires-python and align README/AGENTS/package classifiers/locks/support policy/release notes in one reviewed compatibility change. Do not leave metadata broader than tested intent.

Non-goals

• no numerical/psychometric behavior change;
• no weakening of coverage/docstring/security/package gates;
• no competing workflow writer while ci: replace stale Python 3.14 branch on protected-main lineage #689 owns .github/workflows/ci.yml;
• no release solely because compatibility CI is green;
• no counting ci: replace stale Python 3.14 branch on protected-main lineage #689 active-PR evidence as protected-main support before merge.

Closure

Close only after protected main has exact evidence that the advertised minimum Python runtime is either fully tested by the complete Rust-primary suite or deliberately removed from the support contract, with package metadata, support policy and public documentation aligned.

[seonghobae]

Protected-main closure evidence: #703 empirically proved the hash-locked CI environment could not support the advertised 3.10 floor and raised requires-python to >=3.12; a later Sentinel merge accidentally reverted that accepted compatibility contract. PR #713 has now restored requires-python = ">=3.12", the matching CPython 3.12/3.14 full-suite contract, AGENTS guidance and authoritative changelog on current protected main c8c834edb11e19952bf7e84ee384b37f471ae563. The transient 3.10 re-test Draft #712 is closed superseded. Closing because protected main now advertises only the tested/installable minimum.