Pin prod runtime to Python 3.13; refresh CI tier comment

.github/workflows/ci.yml

@@ -38,9 +38,12 @@ jobs:
         with:
           version: '0.16.9'
 
-  # Stage 1: install + app-factory smoke test. The Python matrix mirrors the
-  # supported range of the tracked Campus packages (campus-suite weekly and
-  # campus-api-python main both declare >=3.11,<3.14); keep the three in sync.
+  # Stage 1: install + app-factory smoke test. The Python matrix covers the
+  # security tier (3.11-3.13): officially supported per the campus Python
+  # support policy. campus-suite weekly and campus-api-python main declare
+  # >=3.11,<3.15 because they additionally CI-test bugfix-tier 3.14
+  # (allow-to-fail); admin supports the security tier only. Keep the
+  # security-tier part of the range in sync across the three.
   smoke:
     name: Smoke Test (${{ matrix.python-version }})
     needs: ruff

.gitignore

@@ -83,9 +83,8 @@ profile_default/
 ipython_config.py
 
 # pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-.python-version
+#   .python-version IS tracked here: it pins the Railway/Nixpacks prod
+#   runtime to a security-tier release (campus Python support policy).
 
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.

.python-version

@@ -0,0 +1 @@
+3.13