Build Python SDK artifacts before publishing the runtime (#44061)

## Why

The SDK release workflow published the runtime before building the SDK, so an SDK build failure could leave the runtime published on its own.

## What changed

- Extract a reusable SDK build workflow that packages checked-in generated code and runs alongside runtime preparation. Require both builds before publishing the runtime, and verify runtime availability before publishing the SDK.
- Add `stage-sdk --codex-version` to set an explicit runtime dependency independently of the SDK version, retaining the checked-in pin by default and rejecting missing or duplicate pins.
- Accept Codex release tags in the runtime version resolver and use its normalized Python version for standalone runtime PyPI verification.

## Testing

Add coverage for wheel and source distribution metadata, preservation of checked-in code, independent beta SDK versions, runtime tag normalization, and invalid versions or dependency pins.

GitOrigin-RevId: feb572fadcf5d148814b26b480b4bae5ef6a39c5

.github/workflows/python-sdk-release.yml

@@ -75,14 +75,25 @@ jobs:
     with:
       runtime_version: ${{ needs.resolve-python-release.outputs.runtime_version }}
 
-  # Always publish the exact pinned runtime from this top-level workflow before
-  # building the SDK package. PyPI does not support reusable workflows as
-  # Trusted Publishers.
+  build-python-sdk:
+    name: build-python-sdk
+    needs: resolve-python-release
+    permissions:
+      contents: read
+    uses: ./.github/workflows/python-sdk-build.yml
+    with:
+      sdk_version: ${{ needs.resolve-python-release.outputs.sdk_version }}
+      runtime_version: ${{ needs.resolve-python-release.outputs.runtime_version }}
+
+  # Publish from the top-level workflow: PyPI does not support reusable
+  # workflows as Trusted Publishers. The runtime must be available before
+  # publishing the SDK that depends on it.
   publish-python-runtime:
     if: github.repository == 'openai/codex'
     name: publish-python-runtime
     needs:
       - prepare-python-runtime
+      - build-python-sdk
       - resolve-python-release
     runs-on: ubuntu-latest
     environment: pypi
@@ -120,64 +131,6 @@ jobs:
           uv run --no-project --with packaging==26.2 python .github/scripts/verify_pypi_release.py \
             openai-codex-cli-bin "$PYTHON_RUNTIME_VERSION"
 
-  build-python-sdk:
-    if: github.repository == 'openai/codex'
-    name: build-python-sdk
-    needs:
-      - publish-python-runtime
-      - resolve-python-release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Build Python SDK package
-        shell: bash
-        env:
-          SDK_VERSION: ${{ needs.resolve-python-release.outputs.sdk_version }}
-        run: |
-          set -euo pipefail
-
-          # Build in a glibc Linux image so release type generation installs
-          # the pinned manylinux runtime wheel.
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -e HOME=/tmp/codex-python-sdk-home \
-            -e UV_LINK_MODE=copy \
-            -e SDK_VERSION \
-            -e SDK_STAGE_DIR="${RUNNER_TEMP}/openai-codex" \
-            -e SDK_DIST_DIR="${GITHUB_WORKSPACE}/dist/python-sdk" \
-            -v "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \
-            -v "${RUNNER_TEMP}:${RUNNER_TEMP}" \
-            -w "${GITHUB_WORKSPACE}/sdk/python" \
-            python:3.12-slim \
-            sh -euxc '
-              python -m venv /tmp/release-tools
-              /tmp/release-tools/bin/python -m pip install build twine uv==0.11.3
-              /tmp/release-tools/bin/uv sync --group dev --frozen
-              /tmp/release-tools/bin/uv run --frozen --no-sync python scripts/update_sdk_artifacts.py \
-                stage-sdk "${SDK_STAGE_DIR}" \
-                --sdk-version "${SDK_VERSION}"
-              /tmp/release-tools/bin/python -m build \
-                --wheel \
-                --sdist \
-                --outdir "${SDK_DIST_DIR}" \
-                "${SDK_STAGE_DIR}"
-              /tmp/release-tools/bin/python -m twine check --strict "${SDK_DIST_DIR}/"*
-            '
-
-      - name: Upload Python SDK package
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: python-sdk-package
-          path: dist/python-sdk/*
-          if-no-files-found: error
-
   publish-python-sdk:
     name: publish-python-sdk
     needs: