CI never tests Python 3.11, and one test fails there #711

CI sets PYTHON_VERSION: "3.11", but its Test job runs on 3.12. uv sync and uv run follow .python-version (3.12), not the interpreter actions/setup-python installs, so Python 3.11, which we target, isn't tested at all.

On the CI run for main (155dcc1), the Test job's log shows Using CPython 3.12.7 and platform linux -- Python 3.12.7.

One test already fails on 3.11, locally on macOS with UV_PYTHON=3.11, on both 075556e and 155dcc1:

tests/darnit/core/test_module_path_policy.py::TestRefused::test_refused_module_is_never_imported
AssertionError: assert ['darnit_baseline'] == []

The module it imports is the installed darnit_baseline plugin, not the refused darnit_not_installed_xyz, so the refusal itself holds on that run. I haven't established why this differs on 3.11. On a tree with #670, #671, #672, #693, #668, #610, #614 and #667 merged into main, the full suite on 3.11 had that one failure (5309 passed, 11 skipped), and on 3.12 it passed (5310 passed, 11 skipped).

Pinning 3.11 with uv run --python 3.11 isn't a valid way to test this. The suite reported about 140 failures, such as No package metadata was found for darnit-baseline, with 3.11 paths in the tracebacks, and the venv was on 3.12 after the run. With UV_PYTHON=3.11 the venv was still on 3.11 after the run and those failures were gone.

Suggested fix: run the Test job on a 3.11 and 3.12 matrix with UV_PYTHON set from the matrix value, and fix or narrow this test so it only asserts that the refused module isn't imported.

Drafted with AI assistance (Claude), reviewed and filed by me. Measurements quoted were executed and verified.