feat(python): qualify a recognized 3.14/3.15 pyc header (#8927)

* feat(python): qualify a recognized 3.14/3.15 pyc header

Python 3.15 is the default `python3` on current Homebrew, but its pyc was rejected with
"Pyc magic 3666 is outside the pinned CPython 3.7–3.13 table" — a message that says
nothing about the file and reads as if the version were unknown. Issue #8206.

Two facts were wrong.

**3.15 was not in the identity table at all,** so `pythonBytecodeIdentity` reported it as
unknown even though the table already pins 3.14 (3627). 3666 is now pinned as 3.15.

**A known identity without a pinned code layout shared one refusal with an unknown
magic.** The two are different outcomes: every 3.7+ pyc carries the same packed 16-byte
header, so a recognized newer magic can still be qualified even when no marshal layout is
pinned for it. The parser now separates them:

    magic 3666 (3.15)  -> CPython 3.15 header is recognized (magic 3666, 16-byte header,
                          flags 0x0, timestamp-based), but no marshal code layout is
                          pinned for that version, so its code objects cannot be decoded.
                          Standalone marshal decoding is pinned for CPython 3.7–3.13.
    magic 1            -> Pyc magic 1 is not a pinned CPython identity, so its header
                          cannot be qualified; ...

The recognized case reports the observed version, the header shape, the PEP 552 flags and
whether the pyc is hash-based or timestamp-based, which is what an agent needs to decide
that a `.jsc`-style text-recovery attempt is pointless and that the file is a 3.15 pyc
rather than a corrupt one. It stays a typed `unsupported` failure: no pinned layout means
no decoded code object, so there is no partial success.

I did not guess a 3.14/3.15 marshal layout. The 3.11+ `TYPE_CODE` order is pinned through
3.13; asserting the same order holds for 3.14 or 3.15 without a real interpreter to
verify against would be an unsupported claim, which is why this change qualifies the
header instead of decoding it.

Docs and the tool description now say marshal decoding is pinned for 3.7–3.13 while the
identity table also recognizes 3.14 and 3.15.

Three regressions fail on the base commit.

* chore: retrigger title and readiness checks after the title was corrected

* test(python): pin the qualified header facts to the packed fields

Review finding. Every new case used `pythonPycHeader(magic)` with its default zero flags
and never asserted the reported flags or header mode, so a refusal that hardcoded
`flags 0x0, timestamp-based` would have passed all of them.

The cases now build the header from explicit fields and assert the facts that field
produces: `flags 0x0/timestamp-based` and `flags 0x1` or `0x3` with a PEP 552 source hash
for hash-based. A separate case parses the same magic in both modes and requires each
refusal to name its own mode and not the other.

Verified by hardcoding `flags 0x0` in the refusal: the two hash-based cases fail.

docs/python-pyc.md

@@ -81,9 +81,14 @@ The inline Evidence result contains the artifact path, SHA-256, and byte length.
 
 - `magic`, the 16-bit little-endian field;
 - `python_version` and `code_layout`, mapped from the pinned CPython 3.7–3.13
-  table (`py37`, `py38`, or `py311`); 3.11 alpha magics before 3494 used
+  marshal table (`py37`, `py38`, or `py311`); 3.11 alpha magics before 3494 used
   other code layouts and are unsupported. The 3.7.0a1/a2 magics 3390/3391
-  used 12-byte headers and are outside this reader's supported format;
+  used 12-byte headers and are outside this reader's supported format. The
+  identity table also recognizes 3.14 (3627) and 3.15 (3666): those magics
+  carry the same packed 16-byte header, so the typed refusal names the observed
+  version and flags, and says that no marshal code layout is pinned for it.
+  Without a pinned layout the code objects cannot be decoded, so a recognized
+  version is still not a successful decode;
 - `flags`, `hash_based`, and `check_source` from PEP 552;
 - `source_hash_hex` for hash-based pycs, or `source_mtime` and `source_size`
   for timestamp pycs.
@@ -180,9 +185,11 @@ name-table entry (`co_names`, varnames, freevars, cellvars, and
 Copied constant tables and each reported nested code relationship count
 against that same object budget. Integer digits and expanded
 set or dictionary keys, including a shared tuple repeated at each level, count
-against the string budget. Magics outside the pinned 3.7–3.13 table,
-truncated headers, trailing marshal bytes, and a non-code top-level object are
-typed failures.
+against the string budget. Magics outside the pinned identity table, truncated
+headers, trailing marshal bytes, and a non-code top-level object are typed
+failures. A recognized 3.14/3.15 magic is a typed unsupported failure too: the
+header is qualified from its packed 16-byte fields, but no marshal code layout is
+pinned, so no code object is reported and the result is never partial success.
 
 A decoded header does not prove the matching `.py` is present. `python_version`
 is the magic table, not a running interpreter. This workflow does not recover