python-pins: declare actionkit as a library and add a PR gate

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+
+# This repo has no PR gate. The pins check is the whole job -- it is cheap, needs
+# no secrets, and stops the Dockerfile and the manifest drifting apart again.
+# Adding it does NOT make this repo tier 2: nothing here auto-merges.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: WeMoveEU/ci-workflows/.github/actions/python-pins@v14

pyproject.toml

@@ -21,6 +21,13 @@ build-backend = "setuptools.build_meta"
 [tool.setuptools]
 packages = ["actionkit"]
 
+[tool.python-pins]
+# requires-python is a compatibility range here, not a runtime pin: six repos
+# import this library from an unpinned git URL and they span 3.11 to 3.14, so no
+# single ==X.Y.* satisfies all of them. `library` opts out of the form rule only
+# -- the values still have to agree with each other.
+role = "library"
+
 [dependency-groups]
 dev = [
     "pytest>=7.0.1",