Add least-privilege permissions to workflows

Add least-privilege permissions to CI workflow

Move API key secrets from workflow-level to step-level env

Fix EXPLOSIONBOT_TOKEN leak in explosionbot.yml

Pin GitHub Actions to commit SHAs for supply chain security

Add release notes for v0.7.4

Filter langchain-core pydantic v1 warning on Python 3.14

Tmp

Update dev deps: langchain 1.x, openai 1.x, drop stale pins

Guard test_langchain.py with importorskip to prevent collection crash on 3.14

Update langchain to 1.x, make import lazy for 3.14 compat

Update langchain dependency to >=0.3 (drops pydantic.v1 shim)

Migrate from pydantic v1 to v2 native API

Add Python 3.14 to classifiers and CI matrix

Drop Python 3.9, add 3.13, update CI