ci(python): verify Python 3.7–3.14 on Windows and Linux

[AScriver]

Adds a 16-job source compatibility matrix for x64 CPython 3.7–3.14 on Windows Server 2022 and Ubuntu 22.04, triggered by pushes and pull requests. README, AGENTS, and classifiers now describe this tested range while retaining Python >=3.7 and the standard-library-only runtime.

Canonicalizes temporary roots in three test fixtures so their failure-injection predicates target the extractor's resolved paths, including the Windows runner's short-name TEMP alias. All existing assertions remain active. The workflow records interpreter and path diagnostics and uses pinned actions, read-only contents permission, independent matrix jobs, and separate source-test/syntax steps.

Validation at 2940fe551315696602f5eb3c453a5c4781a45c34:

• Push matrix and pull-request matrix: all 16 jobs passed in each run; every job discovered 111 tests and passed compileall. Python 3.7–3.10 skipped only the existing tomllib metadata assertion; Python 3.11–3.14 had no skips.
• Local Windows 3.14.3: all 111 tests passed under real and symlink-aliased TEMP; Windows 3.11.9 also passed all 111. Syntax checks passed on both.
• Fresh isolated editable install, documented imports, and CLI help passed on Windows 3.14.3; package/docs file hashes match this final checkout. Actionlint 1.7.12 and git diff --check passed.

Implements Actionables task 67 under work item 64. Installed wheel/sdist acceptance remains the separate task 68.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-25T02:15:02.554075Z	2940fe5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.