ci: test the Python event source

[ryanduguid]

Summary

• run on pull requests and test the event source instead of checking out upstream master
• test the declared Python 3.8 floor, 3.12 and 3.13 ceiling with pinned, read-only actions and bounded runtime
• replace manual virtualenv/sudo installs with the configured Python environment and pip check
• run a runtime dependency audit and build the PEP 517 package on Python 3.13
• pin Node 24.18 and Prism 5.16.0, then wait for all nine mock ports instead of sleeping for a fixed interval
• pin all nine mock inputs to reviewed Xero-OpenAPI commit ee65f8bddb16f37cde3e32741d465eeed6507a74; update that SHA deliberately when the test contract changes
• keep linting focused on fatal Python errors rather than trying to reformat hundreds of generated files in CI
• clean up Prism even when setup or tests fail
• cancel superseded runs for the same pull request to avoid overlapping nine-process mock suites

Validation

• actionlint .github/workflows/build-test-lint.yml
• static assertions that the OpenAPI ref is a full commit SHA, the mock script rejects branch refs and the build runs on Python 3.13
• python -m pip check
• python -m pip_audit -r requirements.txt — no known vulnerabilities
• python -m flake8 --select E9,F63,F7,F82 xero_python
• python -m build
• all nine Prism mocks reached ready state locally with Prism 5.16.0
• 167 of 168 tests passed on Windows; one existing pre-epoch datetime.timestamp() portability failure was isolated and will be proposed separately

The CI audit tool is pinned to pip-audit 2.10.1. Other dependencies, including the CI-only build tool, retain the repository's existing open requirement policy; this workflow is therefore not a hermetic dependency build and does not introduce a lock policy. The authoritative result for the Linux Python 3.8/3.12/3.13 matrix is this pull request's exact-head Actions run. The pull request remains a draft until those hosted checks finish.