[luisgf]

Two small, independent changes from the 2026-10-04 task review (#249).

ci: run every extra and gate on the Python 3.15 pre-release leg (#243)

lxml 6.1.3, librt 0.16.0 (mypy) and MarkupSafe 3.0.4 (pdoc) now ship cp315 wheels, so the advisory 3.15 job no longer has to stop at [eudi]. It now runs what a test leg runs:

• installs [dev,ldp,eudi,ldp-sd,oid4vci], still --only-binary :all:, so the next missing wheel is a loud install failure rather than a silent source build;
• runs flake8, mypy, and pytest with OPENBADGES_REQUIRE_LDP_SD=1 / OPENBADGES_REQUIRE_OID4VCI=1 and the coverage gate.

It stays continue-on-error and outside the publish gate. CPython 3.15.0 final slipped to 2026-10-09 (PEP 790; rc3 on 2026-10-02). After that, folding it into the test matrix and adding the trove classifier is the remaining build: step of #243.

docs: explain why the unversioned OB3 context URL is pinned, not mirrored (#324)

https://purl.imsglobal.org/spec/ob/v3p0/context.json resolves to the bundled 3.0.3 revision. I re-checked 1EdTech's live endpoint on 2026-10-04: it serves an older revision (sha256 b077fa13…dd48ac10, closest to 3.0.1 but byte-identical to none of 3.0.1–3.0.3). Its top-level name and description redefine terms the VC 2.0 context marks @protected, so pyld refuses to expand a VC 2.0 credential against it ("tried to redefine a protected term"). Tracking those bytes would break every credential naming the URL, so the pin stays. It is now documented in:

• the load_context docstring (the pdoc API reference), plus the provenance comment above the alias;
• the Security Model wiki page, which gives the interop consequence. A third-party credential naming the unversioned URL verifies only if its issuer signed against definitions equivalent to 3.0.3 for the terms it uses; otherwise it fails closed with Invalid Data Integrity proof (signature mismatch). Badges this library issues name context-3.0.3.json and are unaffected.

Fixes #324
Refs #243

Verification

• Local gate on Python 3.14 (.venv, all extras, openvc-core 1.26.0): flake8 clean, mypy --strict clean (57 files), 1793 passed, 6 deselected (conformance_docker), 0 skipped, under both REQUIRE flags; gitlint clean on both commits.
• CPython 3.15.0rc2 (macOS arm64): wheels-only install of [dev,ldp,eudi,ldp-sd,oid4vci], pip check clean, flake8 and mypy --strict clean, 1793 passed with coverage 93.12% (gate 93%). The one skip is the Docker conformance module (no requests), which the default marker deselects anyway. Linux cp315 wheels for lxml/cffi exist on PyPI; this PR's own py3.15 run is the first Linux check.
• The live-context finding was reproduced by canonicalizing a VC 2.0 OpenBadgeCredential against the fetched bytes in a fresh process.