Add python-pins drift check

[aaronelliotross]

Implements docs/python-pins.md in WeMoveEU/dependency-policy. Composite action plus a pytest suite the ci gate now runs.

What this adds

• .github/actions/python-pins/ — a stdlib-only checker that finds every place a repo names a Python version (Dockerfile FROM, requires-python, uv.lock, .python-version, .tool-versions, workflow python-version: inputs, ruff/mypy target pins) and fails when they disagree, or when requires-python is written as a floor instead of ==X.Y.*.
• Composite action, not a reusable workflow, for the same reason as docker-smoke: github.action_path lets the script travel with the action, and a step inside the caller's ci job keeps the required status-check context exactly ci.
• Libraries opt out of the form rule with [tool.python-pins] role = "library" — they still have to agree with themselves. actionkit-api is consumed by six repos spanning 3.11 and 3.14; no single exact pin satisfies both.

Why the form rule matters

requires-python is a floor. >=3.10 is satisfied by 3.14, so when Dependabot walked seven repos' Dockerfile FROM to python:3.14 between 2026-06-20 and 2026-08-24, every build stayed green. zenbaki, the only repo with a ceiling, is the only one that never drifted.

Closes the actionlint-only caveat

ci here was actionlint only — the caveat tiers.yml already flags, since a broken action reaches every consumer the moment v14 moves. This PR adds the checker's own pytest suite to that job, so a broken parser cannot reach @v14.

Verification

19 tests pass. Also run against two real repos before commit:

• helpscout-webhook-handler → exit 1, correctly reporting 3.13 in .python-version/requires-python/uv.lock against 3.14 in the Dockerfile.
• analytics → exit 1 on the form rule only; all five sites agree on 3.13.