python-pins: declare actionkit as a library and add a PR gate

[aaronelliotross]

Plan Task 18 — the prerequisite for the 3.14 fan-out (Tasks 7–10), and the first repo wired to WeMoveEU/ci-workflows/.github/actions/python-pins@v14.

What changes

• pyproject.toml: adds [tool.python-pins] role = "library". requires-python is deliberately unchanged at >=3.11.
• .github/workflows/ci.yml: new. This repo had no PR gate at all.
• uv.lock: untouched — uv lock is a genuine no-op here, since nothing changed for the resolver.

Why this library keeps a floor

Every other Python repo in the org is moving to requires-python = "==X.Y.*", because a floor is satisfied by every later Python — which is how seven repos let Dependabot walk their Dockerfile to python:3.14 with green builds while their manifests stayed put.

This repo is the exception. Six repos (bankimporter twice, we-babel, youmove-form, actionkit-updater, fundraiser-api) import actionkit from an unpinned git URL, resolved at their uv lock time, and they span 3.11 to 3.14. No single exact pin works: ==3.11.* breaks every 3.14 consumer's lock, ==3.14.* breaks fundraiser-api's. So the library role opts out of the form rule — values must still agree with each other.

Verification

Green case, on this tree:

python-pins: every site that names a Python version (role: library)

  pyproject.toml  requires-python   >=3.11                  -> 3.11
  uv.lock         uv.lock           >=3.11                  -> 3.11

OK: all 2 sites agree.

Red case, proved on a throwaway branch (#11, closed unmerged): a Dockerfile on python:3.14-slim against this manifest turned ci red in 6s with

FAIL:
  * Python version disagrees: 3.11 in pyproject.toml (requires-python), uv.lock (uv.lock); 3.14 in Dockerfile (dockerfile)

which also confirms in a real repo that role = "library" exempts only the form rule, not agreement.

Separately, not in this PR

Six repos depending on this library at whatever main says is its own problem: Dependabot's cooldown and no-majors rules cannot touch a floating git dependency, so this library reaches production unversioned and ungated. Tagging it and pinning the consumers changes six lockfiles and deserves its own review.