test(ci): run Python client CI across a 3.9-3.13 version matrix

[inureyes]

Summary

python/pyproject.toml declares requires-python = ">=3.9" and classifiers for 3.9 through 3.13, but .github/workflows/python.yml pinned a single interpreter (3.11) with no version matrix, so four of the five supported versions never executed the test suite.

What changed

• Split the single check job in .github/workflows/python.yml into a lint job (ruff check, ruff format --check, mypy python/src, unchanged, still a single leg on Python 3.11 since both tools are already pinned to py39 semantics) and a test job (pytest python/tests -m "not e2e", now matrixed over python-version: ['3.9', '3.11', '3.13'] with fail-fast: false so one version's failure does not mask the others).
• Narrowed the classifiers list in python/pyproject.toml from 3.9-3.13 (five entries) to the three versions CI now actually exercises (3.9, 3.11, 3.13), so the published metadata and the tested matrix agree. requires-python stays ">=3.9" unbounded since that constraint is unaffected by which versions CI happens to test.
• No changes to python/src/.

Test plan

• Local Python 3.9 (system CPython 3.9.6 via uv venv): pip install -e "python[dev]" resolves cleanly, pytest python/tests -m "not e2e" -q passes 43/43.
• Local Python 3.11 (uv-managed 3.11.10): same install and pytest, plus ruff check, ruff format --check, and mypy python/src all pass.
• Local Python 3.13 (uv-managed 3.13.5): same install and pytest, passes 43/43.
• python.yml parses as valid YAML with the expected job names (lint, test).
• CI run on this PR: lint, test (Python 3.9), test (Python 3.11), and test (Python 3.13) all pass.

Closes #1115