chore(ingestion): pin basedpyright analysis to py3.10; CI runs once

Following the basedpyright + multi-Python-version research:

- ingestion/pyproject.toml: add `pythonVersion = "3.10"` to
  [tool.basedpyright] so type-checking always analyzes for the lowest
  supported Python version. Forward-incompatible code (tomllib usage,
  PEP 695 generics, etc.) is caught at type-check time regardless of
  which Python interpreter runs the checker.
- .github/workflows/py-tests.yml: gate the "Run Static Checks" step on
  `matrix.py-version == '3.10'`. With pythonVersion pinned, results are
  identical across the matrix; running once avoids redundant work and
  keeps the baseline file deterministic. Unit tests still run on the
  full 3.10/3.11/3.12 matrix to verify runtime compatibility.
- ingestion/.basedpyright/baseline.json: regenerated cleanly with the
  new pythonVersion config (~18.8K errors / ~37.3K warnings, similar
  scale to the previous baseline). Aligns with the canonical
  type-check-on-floor / test-on-matrix pattern used by Pydantic, CPython,
  and other major Python projects.

.github/workflows/py-tests.yml

@@ -99,6 +99,11 @@ jobs:
           install-server: 'false'
 
       - name: Run Static Checks
+        # basedpyright is configured with `pythonVersion = "3.10"` (the lowest
+        # supported version) so type-checking results are identical across the
+        # 3.10/3.11/3.12 matrix. Run on the lowest version only to avoid
+        # redundant work and keep the baseline file deterministic.
+        if: matrix.py-version == '3.10'
         run: |
           source env/bin/activate
           cd ingestion

ingestion/pyproject.toml

@@ -280,6 +280,13 @@ exclude = [
   "src/metadata/__version__.py",
 ]
 
+# Pin the analysis target to the lowest supported Python version so
+# basedpyright catches forward-incompatible code (e.g. tomllib usage,
+# PEP 695 generics) at type-check time. Runtime support across 3.10/3.11/
+# 3.12 is verified separately by the unit-test matrix in py-tests.yml.
+# Keep this in sync with `requires-python` above.
+pythonVersion = "3.10"
+
 # Existing violations are grandfathered via .basedpyright/baseline.json
 # (regenerate with `basedpyright -p ingestion/pyproject.toml --writebaseline`
 # from the ingestion/ directory). New violations in any file fail CI.