Fix CI: pin Python to 3.13 to match Pipfile.lock

[caglarpir]

The PyTest workflow currently fails on every PR, before any test runs.

Cause

pytest.yml requests python-version: "3.x", which resolves to whatever the newest CPython on the runner is — today 3.14.7. Pipfile.lock pins scipy==1.15.3, and that release publishes wheels only up to cp313. With no matching wheel, pip falls back to building scipy from its sdist, which needs BLAS:

Run-time dependency scipy-openblas found: NO  (tried pkg-config)
Run-time dependency openblas found: NO  (tried pkg-config and cmake)
../scipy/meson.build:274:9: ERROR: Dependency "OpenBLAS" not found (tried pkg-config and cmake)

ubuntu-latest has no OpenBLAS, so the build dies and make setup-dev exits non-zero:

make: *** [Makefile:42: setup-dev] Error 1

(scipy is not a direct dependency — it arrives transitively via turfpy.)

This is time-based rot rather than a regression from any one commit: the last green run of this workflow on main was 2025-07-21. Python advanced to 3.14 while the lockfile stayed frozen, so the unpinned "3.x" drifted off the end of what the lockfile can resolve.

Fix

Pin python-version to "3.13" — the newest interpreter the current lockfile resolves against. I checked all 73 locked packages against PyPI: every one either ships a universal wheel or a cp313 manylinux wheel, and the single sdist-only dependency (turfpy==0.0.7) is pure Python with no build requirements.

pypi-publish.yml runs the same pipenv install --dev against the same lockfile and carries the same "3.x", so it is pinned identically — otherwise the next push to main would fail the same way at publish time.

Alternative considered

Regenerating Pipfile.lock for 3.14 would also work and would let CI track "3.x" again, but it is a dependency refresh across 73 packages and a much larger change to review. The pin restores the signal with a two-line change; refreshing the lockfile is worth doing separately and deliberately.

Notes

Out of scope, but noticed nearby and worth a follow-up:

• main-docs.yml declares python-version: [3.6] in a matrix that is never consumed — the job only runs yarn/npm, so the value is a no-op leftover.
• pypi-publish.yml sets environment.url to https://pypi.org/p/notehub-py, which looks copy-pasted from another project.

Test plan

CI on this PR is the test: the build job should now get through Install dependencies and run black, flake8 and pytest.