ci: drop Python 3.11, test on 3.12 + 3.14, add job timeouts

[jqnatividad]

Drop Python 3.11, move the test matrix to 3.12 + 3.14, and stop a hung job from
burning a full runner day.

Why

tests/unit/test_query_stream.py::test_cancelled_stream_reader_cancels_worker
deadlocks on Python 3.11 only. gateway/query_stream.py::query_events does
worker.cancel() and then await worker inside an anyio.CancelScope(shield=True)
in its finally; on 3.11 that shielded await never completes when the consumer
task is cancelled, so the cancelled reader never finishes and the event loop sits
idle with nothing runnable. Reproduced locally in a 3.11 venv; passes on 3.12 and
3.14.

This was introduced by fa50bfb (#7) and has hung every CI run since — the last
green run was the commit immediately before it. Three runs were cancelled at
roughly 6h, 1.5h and 6h, because no job carried a timeout-minutes.

3.14 joins the matrix because the Dockerfile ships python:3.14-slim, so the
deployed interpreter was the one version CI never exercised.

Changes

• requires-python = ">=3.12"; ruff target-version = "py312"; mypy python_version = "3.12"
• CI matrix ["3.12", "3.14"], and timeout-minutes on all three jobs
• uv.lock regenerated (drops async-timeout and tomli, both 3.11-only backports)
• Support claims updated: README badge and prerequisites, CONTRIBUTING gate table,
  .roborev.toml, issue-template placeholder
• Serena memories record why 3.11 was dropped, so the decision survives

Verified

802 passed, 2 skipped on both 3.12 and 3.14 locally; ruff check clean under the
new target; uv lock --check clean.

Not fixed here

• The deadlock itself. This removes the interpreter that exposes it; query_events
  still has the shielded-cleanup bug. Restoring 3.11 would meet it again.
• Dockerfile:62 still copies /usr/local/lib/python3.11/site-packages while the
  base image is python:3.14-slim, so that path does not exist in the builder stage
  and the image build almost certainly fails. No workflow builds the image, which is
  why docker: bump python from 3.11-slim to 3.14-slim #3 shipped it unnoticed. Separate bug, separate PR — unverified here because no
  Docker daemon was available.

🤖 Generated with Claude Code