ci: test RAG showcase across Python versions

[TristanKruse]

Summary

Add a focused GitHub Actions workflow for the RAG showcase:

• run the locked pytest suite on Python 3.10, 3.11, 3.12, and 3.13
• pin third-party actions to immutable commit SHAs
• use read-only repository permissions
• cancel superseded runs and apply a job timeout
• cache uv dependencies

Validation

• workflow YAML parsed successfully
• uv sync --locked --all-extras: passed
• uv run --locked pytest -v: 10 passed, 4 xfailed
• git diff --check: passed