ci: a weekly latest-release lane and surface probes for every tested runtime; SUPPORT.md and the integration process

[philpaz]

CI tested LangGraph only at the pinned 1.2.12, so a new release was never checked against the gate. LangGraph 1.2.14 shipped on 2026-10-06. This PR adds the missing half, and writes down one process every future runtime follows.

The two lanes

• Pinned lane (unchanged, required): the two LangGraph example jobs in ci.yml keep their names and exact versions, and now also run the new surface probe.
• Latest lane (new): .github/workflows/compat.yml runs weekly and on demand. It installs the newest release of each tested runtime's packages and runs the same tests and probe. It never runs on a pull request, so a framework release can never block a contributor. It joins the required checks only if you decide it should; as designed, it stays advisory.

What the gate can see in LangGraph

tests/test_compat_langgraph.py pins the LangGraph surface the gate depends on:

• Every route is gated: invoke, four stream modes, a subgraph, stream(subgraphs=True), ainvoke and astream with the async hook, and ainvoke with only the sync hook. Each one passes every call through the hook, the refused call never runs, and the allowed ones do.
• A negative control: an ungated node does run the refused call.
• Arguments: the hook sees the arguments the tool runs with.
• A crashing hook: a hook that raises stops the call.
• Injected arguments: they reach the gate but not the tool.

Passes on LangGraph 1.2.12 with langchain-core 1.6.5, and on 1.2.14 with 1.6.9, on Python 3.10 and 3.12.

The process, written once

• CONTRIBUTING.md, "Adding a runtime": example, tests, surface probe, pinned lane, latest lane, README row.
• STABILITY.md, "Integrations": what Tested means, and what happens when the latest lane fails or passes on a newer release.
• SUPPORT.md: where to ask, and what is supported.
• tests/test_compat_process.py: fails if a runtime joins one lane without the other, the lanes install different packages or run different tests, the probe is missing, or the latest lane runs on pull requests.

Proof (local, on this commit)

• Full gate: ruff, format, mypy and the full suite on Python 3.9 and 3.12, 1808 passed each.
• Workflow audit: zizmor clean, with the same suppressed count as main.
• LangGraph lanes: pinned and latest, each on Python 3.10 and 3.12, 30 passed each.
• Twelve planted erosions, all caught:
  • nine against the process lock;
  • three against the probe: the sync gate bypassed, the async gate bypassed, and a tool running different arguments than the gate judged.