Cover SuiteSparse:GraphBLAS 10.4 and 10.5 in the CI psg pool - #629

The pool stopped at psg 10.3.1.0, so CI installed nothing newer except on
the draw that picks "latest", which does not pin and so never produces a
reproducible combination. Three releases have landed since, and each carries
a SuiteSparse:GraphBLAS this project has to work against: 10.4.0 moved a
field in the matrix struct, and 10.5.0 dropped the post-build iso check that
four tests used to rely on.

psg 10.5.0.0 is on PyPI and, since 2026-08-26, on conda-forge, so the
conda-forge, wheel and source draws all cover it.

`scripts/check_versions.sh` tracks the newest version we test, so its psg
floor moves with the pool.

Only the psg pools change here. The other pools are revised further up this
branch stack, so raising them belongs there rather than in a commit that
would conflict with every rebase.

Add scripts/audit_{pypi,conda}_versions.py, which check the pools and
tables in ci_pick_versions.py against what is actually published. The
--validate stress test proves the picker agrees with the constraints it
documents; it cannot notice when a constraint drifts from reality, since
that happens when a package releases, not when we commit. A new weekly
workflow runs both audits.

In the picker, replace the hand-written scipy/numba compatibility rules
with SCIPY_MAX_NUMPY and NUMBA_MAX_NUMPY ceiling tables, add
SCIPY_MIN_PYTHON, and gate the tables behind check_ceilings() and
check_python_pools() so a half-updated table fails the run instead of
producing a silently wrong pick. Bump the pools to numpy 2.5, scipy 1.18,
awkward 2.13, numba 0.67 and sparse 0.19, and offer sparse on py3.13/3.14
now that numba supports them.

Also bump pre-commit hooks, update check_versions.sh to match, and ignore
PLR0917, CPY and ISC004 (all newly stable in ruff 0.16).

Fixes found while reviewing the above:

- test_and_build.yml discarded the picker's exit status. `eval "$(cmd)"`
  reports eval's status, and that step's shell has no -e, so a picker
  failure left every *ver variable unset and quietly installed the latest
  of everything. Assign first, then fail the step.
- pyproject: bound the sparse py3.14 marker below 3.15. sparse depends on
  numba, so it has to drop out wherever numba does.
- _pick_scipy filtered ceilings and requires-python but not the one numpy
  floor scipy imposes, leaving the order dependence it exists to remove.
- audit_pypi: report a missing scipy release instead of raising KeyError,
  honor a `<=` numpy cap rather than skipping the check, and keep the
  notes section inside the network guard.