build: lock torch 2.12 and cap <2.13

[rbavery]

Locks wherobots-export against the latest released torch (2.12.1) and caps it at <2.13 so an untested torch 2.13 can't be pulled in automatically — letting downstream projects (usda-firecon's FireCon pipeline) move off torch 2.8.

• Constrain torch>=2.8,<2.13; add uv.lock resolving torch 2.12.1 from the pytorch-cpu index (wiring up the previously-declared index via [tool.uv.sources]).
• Add tests/test_export.py covering the .pt2 export path (save → torch.export → package_pt2) with a load_pt2 round-trip and dynamic shapes, plus a dev group (pytest, numpy).
• Add a test workflow running the suite against the locked torch (uv run --frozen).

The torch.export / package_pt2 / load_pt2 API is unchanged across 2.8–2.12, so no library code changed. The floor stays torch>=2.8 so consumers on older torch (e.g. usda-firecon's onboarding at torch 2.8) still resolve; the lock pins the latest.

Downstream follow-up (separate usda-firecon PR): usda-firecon tracks this repo's main; once this lands, uv lock --upgrade-package wherobots-export there picks up the new commit, but its onboarding sub-package pins torchvision==0.23 (→ torch 2.8) and needs its own bump to a torchvision paired with the torch it targets (0.25 for 2.10, 0.27 for 2.12).

Agent details

• Verified end-to-end on torch 2.12.1: save() → .pt2, then load_pt2() → ExportedProgram.module() reproduces eager output (including a dynamic batch dim that differs from the export-time example).
• Test suite passes locally on both 2.8.0 (floor) and 2.12.1 (locked); CI runs against the locked 2.12.1.
• No changes under src/ — the export API surface is stable across the range.
• requires-python unchanged (==3.12.*).

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂

Two real traps in a CI-versioning PR: the --upgrade-package "torch<2.9" flag doesn't pin anything (so your 'floor' leg quietly tests whatever's locked), and the whole suite hangs off a private _package import that's liable to vanish mid-range. Fix those and the green checkmark will actually mean something.

_{2 finding(s) posted.
💬 To request a re-review, comment @salty-hambot review}