ci: run the suite weekly against re-resolved dependencies

Every trigger on this workflow was caused by someone pushing, so the suite
only ever ran against the versions `uv.lock` pins. That is the right thing
for a pull request and the wrong thing as the only signal: a `langgraph`
minor that breaks the runtime is invisible here until a user on a fresh
install hits it. Issue #103 is the standing form of the complaint -- the
extras are unbounded and the lockfile hides what the next major would do.

Adds a Monday cron and one job that re-resolves every range from scratch
(`uv lock --upgrade`) and runs the suite against the newest versions
pyproject.toml's constraints allow. The job is gated to `schedule` and
`workflow_dispatch`: on pull requests it would turn someone's branch red
for an upstream release that branch did not cause.

The re-resolved lockfile diff is printed whether or not the suite passes,
because a green run against moved dependencies is the evidence needed to
widen a range or drop a pin.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Shashankss1205

.github/workflows/ci.yml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main]
   pull_request:
+  # Mondays, 06:00 UTC. Every other trigger here is caused by someone pushing,
+  # so without this the suite is only ever run against the dependency versions
+  # `uv.lock` pins -- see the `upstream-drift` job for what that hides. Note
+  # GitHub disables a scheduled workflow after 60 days with no repository
+  # activity, so a long quiet spell stops these runs rather than failing them.
+  schedule:
+    - cron: "0 6 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -167,6 +174,40 @@ jobs:
         # `addopts` in pyproject.toml supplies `-m 'not live'`.
         run: uv run pytest
 
+  upstream-drift:
+    # `uv.lock` is what every other job resolves against, so nothing in this
+    # workflow would notice a new `langgraph` minor breaking the runtime until a
+    # user on a fresh `pip install grapharc` hit it. Issue #103 is the standing
+    # form of that complaint: the extras are unbounded and the lockfile hides
+    # what the next major would do. This job re-resolves every range from
+    # scratch and runs the suite against the newest versions the constraints in
+    # pyproject.toml actually allow.
+    #
+    # Scheduled and manual only, deliberately. A pull request has to be judged
+    # against the lockfile it ships; if this ran on PRs, an upstream release on
+    # the morning of a review would turn someone else's branch red for a reason
+    # that branch did not cause.
+    name: upstream drift (unlocked deps)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Re-resolve every dependency to the newest allowed version
+        run: uv lock --upgrade
+      - name: Report what moved
+        # Printed whether or not the suite then passes: a green run against
+        # moved dependencies is the useful half of this job, because it is the
+        # evidence that a range can be widened or a pin dropped.
+        run: git --no-pager diff --stat -- uv.lock
+      - name: Sync and test against the re-resolved versions
+        run: |
+          uv sync --all-extras --group dev
+          uv run pytest
+
   build:
     name: build and check the distribution
     runs-on: ubuntu-latest