Raise the Python floor to 3.11, and give the pre-commit workflow the shared gates

Two CI failures, both real, neither visible locally.

**`python-kasa==0.10.2` requires Python >= 3.11** and the test matrix still
ran 3.10, so `pip install -r requirements.txt` could not resolve there. The
floor moves to 3.11 across `requires-python`, mypy and pylint, and the matrix
becomes 3.11/3.12/3.13. Nothing runs 3.10 -- production is system Python 3.14
-- so this documents what was already true rather than dropping support.

**The `pre-commit` workflow never checked out `kuhyx/utils`,** so both
delegating hooks exited 1 with "shared gate not found at
/home/runner/utils/...". That workflow has been red on every run since those
hooks were added; the freshness hook just made it two failures instead of one.
It now checks the shared repo out to `.utils` and points `UTILS_ROOT` at it,
the same way every other workflow in the fleet does.

465 tests at 100% branch coverage in a clean venv; gate exit 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK

.github/workflows/pre-commit.yml

@@ -11,6 +11,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      # Two hooks here delegate to the shared gates in kuhyx/utils. Without
+      # this checkout they exit 1 with "shared gate not found at
+      # /home/runner/utils/..." -- which is what this workflow had been doing
+      # on every run since those hooks were added.
+      - name: Check out the shared gates
+        uses: actions/checkout@v4
+        with:
+          repository: kuhyx/utils
+          path: .utils
+      - name: Point the delegates at that checkout
+        run: echo "UTILS_ROOT=$GITHUB_WORKSPACE/.utils" >> "$GITHUB_ENV"
+
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"

.github/workflows/python-tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v4

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 name = "wake-alarm"
 version = "1.0.0"
 description = "Phone-driven wake alarm with fan ramp and smart-plug control"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 dependencies = [
     "gatelock @ git+https://github.com/kuhyx/utils@gatelock-v0.7.2#subdirectory=gatelock",
     # Firebase transport for the alarm read. _sync.py imports it lazily and
@@ -74,7 +74,7 @@ line-ending = "auto"
 docstring-code-format = true
 
 [tool.mypy]
-python_version = "3.10"
+python_version = "3.11"
 strict = true
 warn_return_any = true
 warn_unused_configs = true
@@ -108,7 +108,7 @@ init-hook = "import sys; sys.path.insert(0, '.')"
 analyse-fallback-blocks = true
 persistent = true
 jobs = 0
-py-version = "3.10"
+py-version = "3.11"
 # "tests" is a basename match: test suites intentionally use patterns
 # (protected-access, magic-value comparisons) that don't apply to source
 # code, matching testsAndMisc's pylint scope (tests are linted by ruff, not