[blackaxgit]

Summary

Declares and CI-tests Python 3.15 (3.15.0 final shipped 2026-10-09). No code change: the full suite already passes on 3.15.0.

• pyproject.toml: Programming Language :: Python :: 3.15 classifier.
• ci.yml / release.yml: "3.15" added to the test matrix.
• uv pin 0.12.10 → 0.13.1 in every setup-uv step (ci.yml, release.yml, audit.yml) and the Dockerfile's ghcr.io/astral-sh/uv COPY (index digest sha256:4a1f3666…a336, amd64 + arm64).
• Docs: AGENTS.md, CONTRIBUTING.md, CHANGELOG.md [Unreleased].

Why the uv bump is required

uv@0.12.10 python install 3.15 installs 3.15.0rc2, which I verified. A 3.15 leg on that pin would test a release candidate while reporting "3.15". uv 0.13.0 is the first release that knows 3.15.0 final. 0.13.1 also fixes 0.13.0's rejection of sdists that contain hard links, and that matters because the 3.15 leg builds PyYAML 6.0.3 from its sdist (PyYAML ships no cp315 wheel). setup-uv v10.3.0 verifies a newer uv's checksum through astral-sh/versions. I checked uv 0.13's breaking changes against this repo and none of them apply: every step pins its interpreter, the Dockerfile sets UV_PYTHON_DOWNLOADS=0, the build backend is hatchling, and the repo has no constraints files and runs no uv build --clear.

Deliberately not changed

• The container image stays on python:3.14-slim-trixie (owner decision).
• Lint, audit and build jobs stay on 3.13.
• No dependency floors added. On 3.15, resolvers already pick a pydantic-core that has cp315 wheels (chore(deps): bump the python-version-updates group with 8 updates #74).

Verification (local, uv 0.13.1)

• uv lock --check passes; the lockfile is unchanged.
• pytest with HYPOTHESIS_PROFILE=ci: 855 passed on 3.11, 3.12, 3.13, 3.14 and 3.15.0.
• On 3.13: ruff format --check, ruff check, mypy src/, bandit and pip-audit all pass.
• release.yml build job, run by hand: uv build, the wheel and sdist smokes on 3.13 and 3.15, and the CycloneDX uv export all pass. The wheel METADATA carries the 3.15 classifier.
• Dockerfile builder stage, run by hand on arm64 against CPython 3.14 (no downloads): both uv sync --locked stages pass and the package imports. A real docker build was not possible locally, so this PR's amd64 docker job is that check.
• gitleaks: no leaks.
• Review panel: claude-fable-5-1 PASS, gpt-6.1-sol no blocking findings, grok-4.7 PASS. All ran on their primary models. Sol also reviewed the plan before implementation.