CI + pinned Python 3.14.3 workflow

[andreabergia]

Summary

Pin the project to a fixed Python 3.14.x patch (3.14.3) and make CI validate that pinned-Python flow on macOS + Linux.

What this changes

• add repo pin in .python-version (3.14.3)
• add scripts to install/resolve a project-local uv-managed Python runtime
• add scripts/dev/checks-with-pinned-python.sh to run fmt/clippy/test with pinned PYO3_PYTHON
• add scripts/dev/pyo3-config-check.sh for PyO3 interpreter diagnostics
• add GitHub Actions CI matrix (ubuntu-latest, macos-latest) for pinned-Python checks
• add --smoke-python CLI flag + e2e test for non-interactive embedded Python startup validation
• export Python library dir (LD_LIBRARY_PATH / DYLD_LIBRARY_PATH) in scripts so test binaries can load libpython at runtime
• add linkage diagnostics in CI:
  • macOS: otool -L target/debug/pychat_ai
  • Linux: ldd on target/debug/deps/pychat_ai-* test binaries
• update README / contributing docs for the pinned-Python workflow and CI matrix

Why

PyO3 links against the interpreter selected at build time. Using a pinned uv-managed Python keeps local and CI builds consistent and avoids host-specific interpreter drift. The Linux runtime-loader fix addresses CI test failures where libpython3.14.so.1.0 was not found.

Validation

• cargo fmt --all --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• GitHub Actions CI passing on ubuntu-latest and macos-latest