Harden core tooling and Supabase secrets

[MaxGhenis]

Summary

• remove embedded Supabase service-role key fallbacks from core compatibility code and scripts
• fail fast when Supabase credentials are not provided, with regression coverage
• align Python metadata with the >=3.11 support floor and add a blocking focused ruff check while keeping full lint/mypy advisory
• clean the focused lint subset touched by the new CI guard

Verification

• UV_FROZEN=1 uv run --extra dev ruff check src/microplex/core src/microplex/targets src/microplex/supabase_targets.py tests/targets tests/test_package_surface.py tests/test_supabase_targets.py
• UV_FROZEN=1 uv run --extra dev pytest tests/ -q
• rg -n "eyJhbGciOi|service_role" .
• npx gitnexus detect-changes --scope staged --repo /private/tmp/microplex-core-clean-slate-1