ci: test every package at its keycardai-* sibling floors

[devin-ai-integration]

Summary

ECO-379. The uv workspace resolves sibling packages to the local checkout, so every existing test runs against sibling code the published floor does not promise. This adds a sibling-floors matrix job to pr.yml beside the langchain version matrix, one leg per package that declares a keycardai-* dependency (a2a, fastmcp, langchain, mcp, starlette, temporal). Existing jobs are untouched.

Per leg:

1. uv build --wheel packages/<pkg> (fetch-depth 0 so uv-dynamic-versioning gets the real version).
2. Parse [project].dependencies for keycardai-*>=X floors. Check each X exists on PyPI first.
3. uv venv plus uv pip install --no-sources <wheel>[test] keycardai-a==X keycardai-b==Y. Siblings come from PyPI at the exact floor; everything else resolves normally. Never falls back to a newer sibling.
4. Run pytest tests/ in that venv (import-smoke alone would catch the fastmcp class but not the starlette class, where the gap is an attribute read a test exercises).
5. On failure, a ::error:: naming the package, the pinned siblings, and the first error line (uv's resolver message for install failures, the first E/FAILED line for tests).

Bootstrap escape hatch (documented in the job comment): if a floor names a sibling version PyPI does not have yet, the leg fails with a distinct "floor ... is ahead of PyPI" message. Adding the floors-bootstrap label to the PR turns that case, and only that case, into a skip so a carrier and consumer can merge together before the carrier releases.

Floor corrections (metadata only, no release triggered)

The job found three live gaps on main. Each floor is raised to the oldest published version where the package's suite passes under the job. The corrected metadata ships with each package's next release; a scoped chore(keycardai-<pkg>) bump can follow, this PR does not trigger one. uv.lock files are unchanged because the workspace records siblings as editable path sources, not specifiers.

• keycardai-fastmcp: keycardai-oauth>=0.7.0 to >=0.12.0. 0.7.0 to 0.9.0 fail to import (keycardai.oauth.server arrives in 0.10.0), 0.10.0 and 0.11.0 fail two AccessContext tests (available_resources is [] instead of None). This is the fix ECO-379's comment flagged.
• keycardai-mcp: keycardai-oauth>=0.9.0, keycardai-starlette>=0.6.0 to >=0.16.0, >=0.9.0. The old pair is unsatisfiable (starlette 0.6.0 requires oauth>=0.13.0); starlette 0.9 to 0.12 import InvalidTokenError, which lands in oauth 0.16.0; starlette 0.8.0 fails a metadata test.
• keycardai-a2a: keycardai-oauth>=0.11.0, keycardai-starlette>=0.3.0 to >=0.16.0, >=0.9.0. KeycardAuthBackend(require_authentication=...) arrives in starlette 0.4.0; 0.4.0 to 0.8.0 fail one metadata test (503 vs 502).

Verified locally for all six legs, plus the ahead-of-PyPI failure and the label skip.

Link to Devin session: https://app.devin.ai/sessions/bbc062cf32b548ef9c4b8b444d2ec67f
Open in Devin Desktop: https://app.devin.ai/desktop/session/bbc062cf32b548ef9c4b8b444d2ec67f?variant=devin
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[Larry-Osakwe]

Reviewed the job line by line: --no-sources floor installs from the index, fail-fast off, fail-closed on unparseable requirements and unpublished floors, bootstrap label skips only the ahead-of-PyPI case. All six legs green is the empirical proof of the three corrected floors.