Build Python SDK artifacts before publishing the runtime (#44061)

## Why

The SDK release workflow published the runtime before building the SDK, so an SDK build failure could leave the runtime published on its own.

## What changed

- Extract a reusable SDK build workflow that packages checked-in generated code and runs alongside runtime preparation. Require both builds before publishing the runtime, and verify runtime availability before publishing the SDK.
- Add `stage-sdk --codex-version` to set an explicit runtime dependency independently of the SDK version, retaining the checked-in pin by default and rejecting missing or duplicate pins.
- Accept Codex release tags in the runtime version resolver and use its normalized Python version for standalone runtime PyPI verification.

## Testing

Add coverage for wheel and source distribution metadata, preservation of checked-in code, independent beta SDK versions, runtime tag normalization, and invalid versions or dependency pins.

GitOrigin-RevId: feb572fadcf5d148814b26b480b4bae5ef6a39c5

.github/workflows/python-sdk-build.yml

@@ -0,0 +1,60 @@
+name: python-sdk-build
+
+on:
+  workflow_call:
+    inputs:
+      sdk_version:
+        description: "Python SDK version to build."
+        required: true
+        type: string
+      runtime_version:
+        description: "Exact Python CLI runtime dependency for this SDK release."
+        required: true
+        type: string
+
+jobs:
+  build-python-sdk:
+    if: github.repository == 'openai/codex'
+    name: build-python-sdk
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Build Python SDK package
+        shell: bash
+        env:
+          SDK_VERSION: ${{ inputs.sdk_version }}
+          RUNTIME_VERSION: ${{ inputs.runtime_version }}
+        run: |
+          set -euo pipefail
+          python3 -m venv "${RUNNER_TEMP}/python-sdk-build-venv"
+          build_python="${RUNNER_TEMP}/python-sdk-build-venv/bin/python"
+          "$build_python" -m pip install build twine packaging==26.2
+          "$build_python" sdk/python/scripts/update_sdk_artifacts.py \
+            stage-sdk "${RUNNER_TEMP}/openai-codex" \
+            --sdk-version "$SDK_VERSION" \
+            --codex-version "$RUNTIME_VERSION"
+          "$build_python" -m build \
+            --wheel \
+            --sdist \
+            --outdir dist/python-sdk \
+            "${RUNNER_TEMP}/openai-codex"
+          "$build_python" -m twine check --strict dist/python-sdk/*
+
+      - name: Upload Python SDK package
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: python-sdk-package
+          path: dist/python-sdk/*
+          if-no-files-found: error