feat(ci): add the shared checks.yml with a derived Python matrix

[lesnik512]

Summary

Part of #95. Adds the reusable .github/workflows/checks.yml that section 7 of the standard describes, with the matrix derived at run time as section 6 requires. Callers come in per-repo PRs; this one is exercised first from a branch ref in db-retry, the postgres repo, so the service-container inputs path is proven before any other repo migrates.

Changes

• .github/workflows/checks.yml: on: workflow_call with the four jobs the standard lists plus a matrix job the others depend on. The matrix job checks out this repo at job.workflow_sha (the documented way for a reusable workflow to reach its own files), fetches endoflife.date/api/python.json, and runs the script below. lint pins the derived floor; pytest fans out over the derived list; docs runs behind the docs input.
• scripts/python_matrix.py: pure derivation, tested. Floor is the >= bound of requires-python; ceiling is the newest cycle whose releaseDate is not in the future, since endoflife.date lists a cycle before it ships; the t entry is the ceiling's. The GIL check's import name is the distribution name with underscores, which holds for every repo in the org.
• Inputs, all optional: docs, free-threaded (off only for the two section 6 exemptions), service-image / service-port / service-options, test-env, free-threaded-env.
• docs/standard.md section 7: the workflow exists now, so the "will live" paragraph becomes the caller snippet and an input table.

Decisions

• One service container, driven by inputs. GitHub's context table lists inputs as available under jobs.<job_id>.services, and an empty image skips the service (documented under jobs.<job_id>.services.<service_id>.image; the runner logs "will not be started because the container definition has an empty image"). The workflow knows nothing about any particular image: service-options is spliced verbatim into docker create (runner source, DockerCommandManager.DockerCreate), so the health command and any -e an image needs come from the caller in Docker's own syntax. Only the health interval, timeout and retries are shared, because how long CI waits is policy, not image knowledge.
• Test env vars go through test-env as KEY=VALUE lines appended to $GITHUB_ENV, because a workflow_call input cannot be a map. free-threaded-env is the same applied only on the t entry: db-retry and faststream-concurrent-aiokafka need a switch there that must not apply to the other entries.
• The derive step uses the runner's python3 (3.12 on ubuntu-24.04) rather than setting up uv, since it only needs tomllib.
• PYTHONDONTWRITEBYTECODE and PYTHONUNBUFFERED, set in some copies, are not carried over; a repo that wants them passes them in test-env.

Checklist

• Lint and format pass (ruff) — run with the library rule set on the two new Python files
• Type check passes (ty)
• Tests pass (uv run pytest: 135 passed, 29 skipped) and mkdocs build --strict is clean
• Build succeeds — no packaging change
• Docs updated — section 7
• Repo metadata stays consistent across the three surfaces — not touched

[lesnik512]

Closed with #95: the org is staying on per-repo _checks.yml. The zero-input shape this could take is recorded on the issue.