ci: qualify CPython 3.14 and bound interpreter support

[doublewhy]

Plain-language summary

• Context: OpenRAE publishes a Python package and needs an explicit, tested interpreter range.
• Problem: Package metadata admitted untested future Python versions, normal CI exercised only Python 3.12, and the MCP tests used event-loop behavior removed in Python 3.14.
• Fix: Qualify standard CPython 3.11–3.14 end to end, preview free-threaded 3.14 separately, reject Python 3.15 for now, and harden the compatibility runner.

Issues closed

Closes #1097

Closes #1117

Closes #1100

• ci: qualify CPython 3.14 and bound interpreter support #1097: bounds Requires-Python to >=3.11,<3.15; aligns classifiers; adds an exact-runtime 3.11–3.14 CI matrix; runs frozen tests, distribution builds, clean wheel installation, metadata/import checks, and CLI smoke tests; and adds a nonblocking 3.14t preview.
• [BUG] MCP tests rely on removed implicit event-loop behavior on Python 3.14 #1117: replaces implicit-loop MCP test calls with asyncio.run(...) and verifies the module with event-loop deprecations promoted to errors.
• fix: reject missing nox policy option values cleanly #1100: routes both policy argument parsers through one guarded option-value reader and tests missing, empty, and option-in-value-position failures.

This is the complete successor to the partial work in #1087 and #1089. It does not edit or close either earlier PR.

Support boundary

• Supported standard interpreters: CPython 3.11, 3.12, 3.13, and 3.14.
• Preview signal only: free-threaded CPython 3.14 (3.14t), scheduled/manual and continue-on-error.
• Not admitted: Python 3.15. A separate post-final dependency and wheel qualification is required before raising the upper bound.

The standard matrix is blocking within the CI workflow: its jobs do not use continue-on-error. Adding its dynamic matrix contexts to protected-branch required checks is an administrator setting outside this PR; this PR does not claim that setting is already configured.

The compatibility session fails closed unless the selected runtime matches the named CPython feature release and threading mode. It restores the matrix selector into Nox's command environment, performs a frozen all-extras sync, runs the hermetic suite, builds one wheel and one source distribution, installs the wheel into a new environment, checks installed Requires-Python, imports every public package, and smokes raes --version plus raes --help.

The MCP dependency remains on the qualified 1.x API line (>=1.28.1,<2) so an unreviewed future major release cannot silently invalidate this compatibility result.

Verification

The branch was rebased onto dev at 96b20ae8422fae9936bae928bbd8a1c14d2001da, retaining the merged #1129 CLI traceability and this PR's #1097/#1100/#1117 traceability. The final rebase also combines #1130's Python 3.11.4 OCI extraction floor with this PR's standard CPython 3.11-3.14 and below-3.15 support boundary.

Local results across the two rebases, with the affected suite, MCP checks, Ruff, and policy graph rerun after the final README resolution:

• Final 3e26db12 head, standard CPython 3.14 affected focused suite: 261 passed and 1 deselected.
• Immediately preceding rebased head, standard CPython 3.11, 3.12, 3.13, and 3.14 plus free-threaded 3.14 focused matrix: 261 passed and 1 deselected per interpreter.
• Immediately preceding rebased head, full standard CPython 3.14 compatibility session: 6,608 passed and 1 skipped; exact-runtime assertion, wheel/sdist build, clean install, metadata/import validation, and installed CLI smoke all passed.
• MCP deprecation-to-error regression: 85 passed.
• Final local docs graph passed Vale with zero findings, executable quickstart tests, warning-as-error Sphinx HTML, and output inventory validation.
• Ruff 0.15.9 check and formatting validation passed for all changed Python/tooling files.
• Repository policy, requirement-diff policy, semantic/assurance/authority/deprecation governance, and ADR immutability checks passed. The optional remote Ground Control requirement lookup was unavailable due local DNS and was skipped by its existing offline policy.

Earlier isolated Ubuntu 24.04 qualification established the complete cross-version path before this rebase:

Runtime	Exact build	Hermetic suite	Build/install/import/CLI
CPython 3.11	3.11.15	6,426 passed, 1 skipped	passed
CPython 3.12	3.12.3	6,426 passed, 1 skipped	passed
CPython 3.13	3.13.14	6,426 passed, 1 skipped	passed
CPython 3.14	3.14.6, GIL enabled	6,426 passed, 1 skipped	passed
CPython 3.14t	3.14.6, GIL disabled	6,426 passed, 1 skipped	passed

The immediately preceding exact head 159f072a9fbfc32570f8346b000f1d959c3d2b60 passed hosted verification: canonical verification passed in 9m58s; the blocking CPython 3.11, 3.12, 3.13, and 3.14 compatibility jobs passed; Sonar passed in 2m23s; and CodeQL, docs, fuzz, supply-chain, container integration, GitGuardian, and title policy passed. After #1130 merged during that run and #1132 merged during the following run, final head 3e26db12df0d0565c9e89ea50ddf27515bbd0938 was rebased onto current dev. Fresh exact-head checks are running; the PR remains draft until they pass.

Scope boundary

No SDL, contract, runtime, evaluator, solver, or backend semantics change. No Python 3.15 production or preview claim is introduced.