ci: test supported Python versions

[Pyhroff]

Summary

• Expand the pytest workflow from a single Python 3.11 job to a 3.10–3.12 matrix.
• Keep workflow permissions read-only and action references pinned to immutable SHAs.
• Use python -m pytest so the test runner is resolved from the selected interpreter.

Validation

CI will execute the existing regression suite independently on Python 3.10, 3.11, and 3.12. The existing CI workflow continues to cover Python 3.9 and 3.12 with the stdlib self-test.