chore(deps): update github-actions to 3.14

.github/actions/signature-verify/action.yml

@@ -14,7 +14,7 @@ runs:
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
-        python-version: '3.12'
+        python-version: '3.14'
     - name: Run signature verification
       shell: bash
       run: |

.github/workflows/agents-63-issue-intake.yml

@@ -1478,7 +1478,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |

.github/workflows/agents-auto-label.yml

@@ -89,7 +89,7 @@ jobs:
         if: steps.eligibility.outputs.should-run == 'true'
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install dependencies
         if: steps.eligibility.outputs.should-run == 'true'

.github/workflows/agents-auto-pilot.yml

@@ -218,7 +218,7 @@ jobs:
         if: steps.check_enabled.outputs.enabled == 'true'
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Cache pip (LLM requirements)
         if: steps.check_enabled.outputs.enabled == 'true'

.github/workflows/agents-capability-check.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install dependencies
         run: |

.github/workflows/agents-decompose.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install dependencies
         run: |

.github/workflows/agents-dedup.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install dependencies
         run: |

.github/workflows/agents-issue-optimizer.yml

@@ -124,7 +124,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true'
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         if: steps.check.outputs.should_run == 'true'

.github/workflows/agents-keepalive-loop.yml

@@ -854,7 +854,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install pydantic langchain-openai langchain-anthropic

.github/workflows/agents-weekly-metrics.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Restore metrics artifact cache
         id: metrics-cache

.github/workflows/health-40-repo-selfcheck.yml

@@ -99,7 +99,7 @@ jobs:
       - uses: actions/setup-python@v6
         if: ${{ env.HAS_ADMIN_TOKEN == 'true' }}
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install enforcement dependencies
         if: ${{ env.HAS_ADMIN_TOKEN == 'true' }}

.github/workflows/health-43-ci-signature-guard.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
       - name: Read signature files
         id: read_signature
         run: |

.github/workflows/health-44-gate-branch-protection.yml

@@ -185,7 +185,7 @@ jobs:
       - uses: actions/setup-python@v6
         if: steps.fingerprint.outputs.should_run == 'true'
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         if: steps.fingerprint.outputs.should_run == 'true'

.github/workflows/health-52-semgrep.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install Semgrep
         run: pip install semgrep

.github/workflows/health-68-consumer-sync-drift.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install pyyaml requests

.github/workflows/health-70-validate-sync-manifest.yml

@@ -56,7 +56,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
       - name: Install dependencies
         run: pip install pyyaml
       - name: Validate manifest

.github/workflows/health-72-template-sync.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install sync dependencies
         run: pip install pyyaml

.github/workflows/health-73-template-completeness.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install pyyaml

.github/workflows/health-74-template-drift.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install checker dependencies
         run: pip install pyyaml

.github/workflows/health-76-codex-cli-freshness.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Emit Codex CLI freshness contract
         run: |

.github/workflows/health-78-backplane-contract.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install jsonschema pytest

.github/workflows/maint-39-test-llm-providers.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |

.github/workflows/maint-50-tool-version-check.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Check current versions
         id: current

.github/workflows/maint-51-dependency-refresh.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Cache uv binary
         id: cache-uv

.github/workflows/maint-52-sync-dev-versions.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Report versions against PyPI
         run: |
@@ -148,7 +148,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Check for pyproject.toml
         id: check

.github/workflows/maint-68-sync-consumer-repos.yml

@@ -88,7 +88,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install pyyaml
@@ -195,7 +195,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install lint tools
         run: pip install ruff pyyaml
@@ -302,7 +302,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: pip install pyyaml

.github/workflows/maint-69-sync-integration-repo.yml

@@ -79,7 +79,7 @@ jobs:
         if: steps.token.outputs.token_available == 'true'
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install uv
         if: steps.token.outputs.token_available == 'true'

.github/workflows/maint-70-fix-integration-formatting.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install formatting tools
         run: |

.github/workflows/maint-71-auto-fix-integration.yml

@@ -172,7 +172,7 @@ jobs:
         if: steps.check_status.outputs.should_fix == 'true' && steps.integration_token.outputs.token_available == 'true'
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install formatting tools
         if: steps.check_status.outputs.should_fix == 'true' && steps.integration_token.outputs.token_available == 'true'

.github/workflows/maint-74-ledger-base-sync.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |

.github/workflows/maint-80-langsmith-metrics-dashboard.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |

.github/workflows/maint-81-langsmith-fleet-conformance.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |

.github/workflows/maint-83-bootstrap-consumer.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Bootstrap consumer settings
         env:

.github/workflows/maint-84-prune-agent-stubs.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Run pruner
         env:

.github/workflows/maint-auto-update-pypi-versions.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Check for outdated versions
         id: check

.github/workflows/maint-dependabot-auto-lock.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install uv
         run: pip install uv

.github/workflows/maint-metrics-retention.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Determine dry-run mode
         id: mode

.github/workflows/maint-sync-env-from-pyproject.yml

@@ -29,7 +29,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Align source files from canonical pin file
         run: |