chore(docker,ci): bump base image to python:3.14-slim and add 3.14 to test matrix

[nicknacnic]

Closes #242 (cherry-pick + extended, re-opened so CI runs against the upstream repo).

Changes

• Dockerfile: bump pinned base image from python:3.11-slim to python:3.14-slim with updated digest (sha256:a7fb1e6…)
• ci.yml: add "3.14" to the test matrix alongside 3.11–3.13

Validation

Ran tests/unit/ locally under Python 3.14.7. Same 11 pre-existing failures as on 3.13 (akamai missing-dep and doctor assertion drift — tracked in #263 and #264); no new regressions introduced by 3.14.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[IngmarVG-IB]

Reviewed alongside the rest of the open queue while unblocking Dependency Audit (#271). The workflow matrix change and the digest-pinned base image bump both look right — Test (Python 3.14) is already green here, so the runtime itself is fine on 3.14.

One gap and one question.

The classifiers weren't updated. pyproject.toml still declares only up to 3.13:

"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",

If 3.14 is supported enough to be in the test matrix and to be the shipped container runtime, it should be in the trove classifiers too — otherwise the published package metadata says otherwise. Worth adding "Programming Language :: Python :: 3.14", in the same commit.

The production runtime moves three minor versions, which is more than the chore label suggests. The FROM change applies to both the builder and the production stage, so this is a real runtime jump for everyone consuming the image, not just a CI matrix addition. That may well be intended, but two things aren't covered by the current checks:

• Test (Python 3.14) is not in the main-protection ruleset's required status checks (it requires 3.11/3.12/3.13 only), so a 3.14 regression won't block a merge until that list is updated.
• The Fresh install job still only runs 3.11 and 3.13 — so nothing exercises a clean install on the interpreter the image actually ships.

Consider adding 3.14 to Fresh install and to the required-checks list if it's going to be the image default. Happy to be told that's a follow-up.

Nothing here is a correctness objection — the diff does what it says.

[IngmarVG-IB]

Approving — the change does what it says and Test (Python 3.14) is green, so the runtime is fine on 3.14. The base image is digest-pinned on both stages, consistent with the existing convention.

Approving with the items from my earlier comment still open, noted here so they don't get lost rather than as blockers:

1. pyproject.toml classifiers still stop at 3.13. If 3.14 is the shipped container runtime and in the test matrix, the published package metadata should say so — "Programming Language :: Python :: 3.14",.
2. Test (Python 3.14) is not in the main-protection ruleset's required status checks (3.11/3.12/3.13 only), so a 3.14 regression won't block a merge until that list is updated.
3. Fresh install still only covers 3.11 and 3.13 — nothing exercises a clean install on the interpreter the image actually ships.

(1) is a one-line follow-up I'd like to see land; (2) and (3) are repo-config follow-ups, not this PR's job.