Fix manual release workflow Python version for Ubuntu 26.04 runners.

Use Python 3.14.6 (available on ubuntu-26.04 via setup-python) instead of
3.14.0, and add a contract test to keep manual-releases in sync with versions.yaml.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Jmevorach

.github/workflows/README.md

@@ -266,7 +266,7 @@ Comprehensive automated testing and validation pipeline that runs on every push
 
 #### **Environment Configuration**
 
-- **Python**: 3.14.0
+- **Python**: 3.14.6
 - **Terraform**: 1.14.6
 - **Kubectl**: v1.34.2
 - **Operating System**: Ubuntu 24.04
@@ -348,7 +348,7 @@ Controlled release management system that allows manual version bumping and rele
 
 #### **Environment Configuration**
 
-- **Python**: 3.14.0
+- **Python**: 3.14.6
 - **Semver Package**: 3.0.4
 - **Operating System**: Ubuntu 24.04
 

.github/workflows/manual-releases.yml

@@ -49,7 +49,7 @@ on:
 
 # Environment variables for consistent tool versions
 env:
-  PYTHON_VERSION: '3.14.0'               # Python version for semantic versioning
+  PYTHON_VERSION: '3.14.6'               # Python version for semantic versioning (semver_packages.python_version)
   SEMVER_PYTHON_PACKAGE_VERSION: "3.0.4" # Specific semver package version
 
 # Required permissions for release operations

docs/MANUAL_RELEASES.md

@@ -336,7 +336,7 @@ The manual release workflow is located at:
 
 | Variable | Description                                                                                 | Default |
 |----------|---------------------------------------------------------------------------------------------|--------|
-| `PYTHON_VERSION` | Python [version](https://www.python.org/doc/versions/) used                                 | `3.14.0` |
+| `PYTHON_VERSION` | Python [version](https://www.python.org/doc/versions/) used                                 | `3.14.6` |
 | `SEMVER_PYTHON_PACKAGE_VERSION` | Version of the PyPi ["semver"](https://pypi.org/project/semver/) package to use             | `3.0.4` |
 
 ### Secrets

tests/bats/contract-tests.bats

@@ -88,6 +88,14 @@ _all_tf_output_names() {
   [[ "$output" == *"$yaml_ver"* ]]
 }
 
+@test "CONTRACT: manual-releases workflow PYTHON_VERSION matches versions.yaml semver_packages" {
+  if ! command -v yq >/dev/null 2>&1; then skip "yq not installed"; fi
+  local yaml_ver
+  yaml_ver=$(yq eval '.semver_packages.python_version.current' "$VERSIONS_FILE")
+  run grep "PYTHON_VERSION:" "${PROJECT_ROOT}/.github/workflows/manual-releases.yml"
+  [[ "$output" == *"$yaml_ver"* ]]
+}
+
 @test "CONTRACT: CI workflow TERRAFORM_VERSION matches versions.yaml" {
   if ! command -v yq >/dev/null 2>&1; then skip "yq not installed"; fi
   local yaml_ver