chore: align CI Python matrix with devguide lifecycle + fix bash 3.2 portability (#3244)

* chore: align CI Python matrix with devguide release lifecycle

Run the pytest matrix only on the bugfix (maintenance) releases — 3.13
and 3.14 — instead of 3.11/3.12/3.13, and point the ruff lint job at the
latest interpreter (3.14). The supported floor stays at requires-python
>= 3.11 (oldest non-EOL security release): older security versions are
supported by claim and fixed reactively rather than gated on a wide
per-commit matrix. Also add macos-latest to the OS matrix so macOS
regressions are caught.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: make bash scripts portable to bash 3.2 (macOS system /bin/bash)

Adding macos-latest to the CI matrix surfaced two pre-existing bash 3.2
incompatibilities (macOS ships bash 3.2 as /bin/bash):

1. update-agent-context.sh embedded Python heredocs inside $(...) command
   substitution. bash 3.2 mis-parses an apostrophe in a heredoc body
   nested in $(...), failing with "unexpected EOF while looking for
   matching `''". Removed the apostrophes from the affected $()-nested
   heredoc body and documented the constraint to prevent regressions.

2. create-new-feature-branch.sh and create-new-feature.sh used the
   bash 4+ ${word^^} uppercase parameter expansion, which errors as a
   "bad substitution" on bash 3.2 and caused short uppercase acronyms
   (e.g. "GO") to be dropped from derived branch names. Replaced with a
   portable `tr '[:lower:]' '[:upper:]'` pipeline.

Verified the full test suite passes under bash 3.2.57 and shellcheck
(--severity=error) is clean.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address review feedback on bash 3.2 portability changes

- create-new-feature.sh: replace the non-portable `\b...\b` grep
  word-boundary (BSD grep treats `\b` as a backspace, so the acronym
  branch could silently fail) with `grep -qw`, matching its twin
  create-new-feature-branch.sh, and pipe the description via
  `printf '%s'` instead of `echo`.
- create-new-feature-branch.sh: switch the acronym check to
  `printf '%s'` as well so both twins are identical and avoid `echo`
  on user-provided text.
- update-agent-context.sh: reword the apostrophe-free self-seeding
  comment to be clearer and less easy to misread.

Verified under bash 3.2.57 (full bash-script suite green) and
shellcheck --severity=error.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Run ruff check
         run: uvx ruff check src/
@@ -30,8 +30,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        python-version: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.13", "3.14"]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0