fix: resolve follow-up quality findings

[mldangelo-oai]

Summary

• centralize the restricted Python-version list used by the reduced CI lane
• replace the progress callback function-with-attached-attributes fixture with an explicit recorder object
• document and guard the internal pytest temp-path factory access used by xdist setup
• replace the protocol ellipsis body that CodeQL flagged as a no-op statement

Validation

• UV_CACHE_DIR=/tmp/modelaudit-uv-cache uv run ruff format modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• UV_CACHE_DIR=/tmp/modelaudit-uv-cache uv run ruff check --fix modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• UV_CACHE_DIR=/tmp/modelaudit-uv-cache uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• PROMPTFOO_DISABLE_TELEMETRY=1 UV_CACHE_DIR=/tmp/modelaudit-uv-cache uv run pytest -n auto -m "not slow and not integration" --maxfail=1