ci(release-readiness): add multi-Python install/verify matrix (3.10–3.13)

Exercises the abi3 promise end-to-end: the published cp310-abi3 wheel must
install and load the Rust extension on every Python version we claim to support.
Previously only Python 3.12 was tested via install-tests; 3.10, 3.11, and 3.13
were entirely unexercised against the published wheel.

New job `multi-python-install-verify` runs after `install-tests`, downloads the
latest dev wheel from Artifact Registry, installs it on each Python version, and
verifies that `import pinecone`, `import pinecone._grpc`, and `GrpcChannel()`
all succeed (lazy constructor, no network required).

Author: jhamon

.github/workflows/release-readiness.yml

@@ -160,6 +160,66 @@ jobs:
           name: install-smoke-results
           path: install-smoke-results.xml
 
+  # ---------------------------------------------------------------------------
+  # Multi-Python install verify: exercises the abi3 promise on every supported
+  # Python version (3.10–3.13). The published wheel is cp310-abi3, so it must
+  # install and load the Rust extension on each Python we claim to support.
+  # ---------------------------------------------------------------------------
+  multi-python-install-verify:
+    name: Multi-Python install verify (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    env:
+      GCP_REGION: ${{ vars.GCP_REGION }}
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+      GCP_REPO_NAME: ${{ vars.GCP_REPO_NAME }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093  # v3.0.0
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install AR keyring backend
+        run: |
+          python -m pip install --upgrade pip
+          pip install keyring==25.6.0 keyrings.google-artifactregistry-auth==1.1.2
+      - name: Install latest dev wheel from Artifact Registry
+        run: |
+          set -euo pipefail
+          INDEX_URL="https://${GCP_REGION}-python.pkg.dev/${GCP_PROJECT_ID}/${GCP_REPO_NAME}/simple/"
+          pip install --pre --extra-index-url "${INDEX_URL}" pinecone
+      - name: Show installed version + Python
+        run: |
+          python -V
+          pip show pinecone | grep -E '^(Name|Version|Location):'
+      - name: Verify import + Rust extension on this Python version
+        run: |
+          python -c "
+          import pinecone
+          print('OK: import pinecone on Python', __import__('sys').version_info[:2])
+          import pinecone._grpc
+          print('OK: import pinecone._grpc')
+          ch = pinecone._grpc.GrpcChannel(
+              endpoint='https://example.invalid:443',
+              api_key='test',
+              api_version='2025-10',
+              version='0.0.0',
+          )
+          print('OK: GrpcChannel constructed:', type(ch).__name__)
+          "
+
   # ---------------------------------------------------------------------------
   # Cross-platform wheel build matrix without injecting dev versions or
   # publishing. Independent signal that release-builds work on every target.
@@ -374,11 +434,12 @@ jobs:
   notify-failure:
     name: Notify on release-readiness regression
     runs-on: ubuntu-latest
-    needs: [integration-tests, install-tests, cross-platform-build, doc-build]
+    needs: [integration-tests, install-tests, multi-python-install-verify, cross-platform-build, doc-build]
     if: >-
       always() &&
       (needs.integration-tests.result == 'failure' ||
        needs.install-tests.result == 'failure' ||
+       needs.multi-python-install-verify.result == 'failure' ||
        needs.cross-platform-build.result == 'failure' ||
        needs.doc-build.result == 'failure')
     permissions:
@@ -401,6 +462,7 @@ jobs:
             "|-----|--------|" \
             "| integration-tests | ${{ needs.integration-tests.result }} |" \
             "| install-tests | ${{ needs.install-tests.result }} |" \
+            "| multi-python-install-verify | ${{ needs.multi-python-install-verify.result }} |" \
             "| cross-platform-build | ${{ needs.cross-platform-build.result }} |" \
             "| doc-build | ${{ needs.doc-build.result }} |" \
             "" \