chore: bump function runtime to Python 3.13 for azure-functions v2

azure-functions v2 (merged from renovate/azure-functions-2.x) requires
Python >=3.13. Bump the Flex Consumption runtime to 3.13 (rg_funcapp.bicep),
the project floor to >=3.13, ruff target to py313, and the CI matrix to 3.13,
and relock.

The 3.11 core-tools image still deploys the 3.13 app: with --build remote the
build runs on Azure at the target runtime, so the image's local Python is
irrelevant (no 3.12/3.13 core-tools image is published). Verified end-to-end:
no-shared-keys + signing deploy succeeds, app runs 3.13, KV reference resolves.

Author: maxdymond

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.11"]
+        python-version: ["3.13"]
     steps:
     - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}

poetry.lock

@@ -7,7 +7,7 @@ license = "MIT"
 version = "1.0.0"
 readme = "README.md"
 authors = [{name = "Max Dymond", email = "max.dymond@alianza.com"}]
-requires-python = '>=3.9.2,<4.0.0'
+requires-python = '>=3.13,<4.0.0'
 dependencies = [
     'azure-functions (>=2.2.0,<2.3.0)',
     'azure-identity (>=1.19.0,<2.0.0)',

pyproject.toml

@@ -39,7 +39,7 @@ var python_container_name = 'python'
 var storage_connection_string = 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${storageAccount.listKeys().keys[0].value}'
 
 // The version of Python to run with
-var python_version = '3.11'
+var python_version = '3.13'
 
 // The name of the hosting plan, application insights, and function app
 var functionAppName = appName

rg_funcapp.bicep

@@ -10,8 +10,8 @@ exclude = [
 line-length = 88
 indent-width = 4
 
-# Assume Python 3.9
-target-version = "py39"
+# Assume Python 3.13
+target-version = "py313"
 
 [lint]
 extend-select = [

ruff.toml

@@ -169,7 +169,13 @@ def deploy(self) -> None:
         if self.subscription:
             func_cmd += f" --subscription {self.subscription}"
 
-        # Publish the application using the core-tools tooling
+        # Publish the application using the core-tools tooling.
+        #
+        # The image's Python version need not match the app runtime: with
+        # '--build remote' the build runs on Azure (Oryx) at the target
+        # runtime, and this image only packages and uploads. 3.11 is the newest
+        # published core-tools image (no 3.12/3.13 exists), and it deploys
+        # 3.13 apps fine.
         cmd = [
             "docker",
             "run",