Drop support for Python 3.7, require deps with 3.12 wheels in the lockfile, and pin CI checks to Python 3.12.