ci: resolve the declared dependency floors on every matrix entry

[lesnik512]

Adds the floors job the org standard requires (standard.md §7), following modern-di-fastapi#56, and extends the existing marker set to cover 3.13.

What the job found

This repo already carried pydantic>=2.12; python_version >= '3.14' for exactly this reason — aiogram pulls pydantic, and pydantic-core ships no cp314 wheel before 2.12. The marker stopped one interpreter short, and it was not the only dependency with the problem.

aiogram>=3.2 resolves to aiogram 3.2.0, which pins pydantic 2.5.3 and aiohttp~=3.9.0. On 3.13 neither installs from a wheel:

error: Distribution `pydantic-core==2.14.6` can't be installed because it is
marked as `--no-build` but has no binary distribution

error: Distribution `aiohttp==3.9.5` can't be installed because it is
marked as `--no-build` but has no binary distribution

Both are needed — bounding pydantic alone lifts aiogram to a release that still pins aiohttp~=3.9, so the second error simply replaces the first:

"pydantic>=2.8.1; python_version == '3.13'",
"pydantic>=2.12; python_version >= '3.14'",
"aiohttp>=3.10.5; python_version == '3.13'",
"aiohttp>=3.13; python_version >= '3.14'",

pydantic 2.8.1 rather than 2.8: pydantic-core 2.20.0 ships a manylinux cp313 wheel but no macOS arm64 one, and 2.20.1 — pydantic 2.8.1 — is the first that covers both. A floor that holds only on the platform CI happens to run is not a floor.

Why the job exists

pytest resolves every dependency at its newest, so the bottom of each declared range ships unexercised. This job resolves direct dependencies at their floors, wheel-only, on every entry of the same matrix pytest uses, and runs the suite against them. Wheel coverage is per interpreter — 3.10 through 3.12 were fine throughout — which is why the job runs on every entry rather than one.

--no-build: a floor reachable only by compiling an sdist is not a floor a user installing a wheel can reach. --no-install-project is mandatory alongside it — --no-build would otherwise refuse to build this project too, and the tests import it from the checkout.

The dev-group floors

uv sync --resolution lowest-direct treats an unbounded name in [dependency-groups] as "any version" and resolves it to that project's first-ever release. These are lower bounds on the test harness only; none constrains aiogram, which the job still installs at 3.2.0 on 3.10–3.12. The resolved-newest path is unchanged.

Verification

Run locally on all six interpreters at the floors: aiogram==3.2.0 on 3.10–3.12, lifted on 3.13–3.14t, 27 passed on each. Resolved-newest path re-checked with just install && just lint-ci && just test-ci.