Comparisons and CI Improvements

[zeth]

API:

• first-class comparisons
• added CasteRange
• Switched the Python tests from pytest style to standard-library unittest

CI:

• Pins GitHub Actions to immutable SHAs, reduces workflow token scope
• pins and hashes the Python build/publish toolchain under python/constraints-*.txt