fix(ci): smoke guard catches tagless builds; DEBUG import must hit the install; pin more workflow invariants

Review findings on PR #13:
- release-branch-semver gives 0.1.0.devN without tags, so the 0.0 guard
  never fired; check_version() now requires >= 0.2 (unit-tested)
- the APPSKELLINGTON_DEBUG child import could resolve the source tree from
  the cwd and false-pass; it now reports its location and must match
- test_ci_workflow: no continue-on-error, matrix python drives container
  and UV_PYTHON, WIP gate compared whole (mutation-tested)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/test_ci_workflow.py

@@ -60,10 +60,27 @@ def test_superseded_pr_runs_cancel_but_push_runs_never_do():
 
 
 def test_every_job_is_wip_gated():
+    # Compared whole, not by substring: `&&` turned into `||` must fail.
+    gate = "github.event_name != 'pull_request' || ( %s && %s )" % WIP_CLAUSES
     for name, job in load()["jobs"].items():
         cond = flat(job.get("if", ""))
-        for clause in WIP_CLAUSES:
-            assert clause in cond, "%s lacks WIP gate clause %s" % (name, clause)
+        assert cond in (gate, "always() && ( %s )" % gate), name
+
+
+def test_no_gate_can_be_softened_by_continue_on_error():
+    # continue-on-error makes needs.<job>.result read success, so ci-ok
+    # would go green over a failure.
+    for name, job in load()["jobs"].items():
+        assert "continue-on-error" not in job, name
+        for step in job.get("steps", []):
+            assert "continue-on-error" not in step, name
+
+
+def test_each_lane_really_runs_its_matrix_python():
+    test = load()["jobs"]["test"]
+    assert test["container"] == "python:${{ matrix.python }}"
+    assert test["env"]["UV_PYTHON"] == "${{ matrix.python }}"
+    assert test["env"]["UV_PYTHON_DOWNLOADS"] == "never"
 
 
 def test_matrix_matches_requires_python():