[itswl]

Dependabot's three base-image PRs (#56 hookprobe, #57 hookjudge, #58 hookrelay: python:3.14-slim → 3.15-slim) could not pass as authored, and not because main was red. Each failed two ways:

• assert_python_pins refused an image on 3.15 that CI still tests on 3.14. The bump has to move the CI pins in the same change.
• The image build could not compile the locked pydantic-core 2.46.4: there is no 3.15 wheel, and slim has no compiler or Rust toolchain.

This PR moves the interpreter as one change instead.

Moved together

• The three Dockerfiles, each service's CI python-version, and the release gate matrix.
• The stdlib helper containers in the compose files, so the project has one interpreter: the demo's sink and stub model, the work stack's sidecars, the production compose.
• The locks, for 3.15 wheels and one 3.15 fix:

package	from	to	why
pydantic / pydantic-core	2.13.4 / 2.46.4	2.14.3 / 2.50.4	first core with a cp315 wheel
httptools	0.8.0	0.9.0	cp315 wheel
uvloop	0.22.1	0.23.0	cp315 wheel
pip-api	0.0.34	0.0.35	pip-audit imports it; 0.0.34's vendored pyparsing imported sre_constants, removed in 3.15 (its #294)

• PyYAML has no 3.15 wheel in any release. On python:3.15-slim its sdist installs as pure Python (measured). The services read YAML only at startup, for config.

Verified before the PR, on 3.15.2

• The full gate on venvs rebuilt with 3.15: STACK GATE GREEN, every suite at its 3.14 count (365 / 196 / 953 / 147 / 32), and the pipe and judge images built.
• The pip-api break was found by the gate, not by the image builds: they install no dev tools.
• The investigator image built on 3.15 (pydantic 2.14.3, SDK 0.2.181), and the offline engine check is unchanged: the turn completes, an allowed read runs, a protected write is refused and never runs, and an @path is not inlined.

Decision note: .agents/notes/implemented/2026-11-13-the-services-run-python-3-15.md. The published images stay on 3.14 until the next release; nothing deployed changes.