Lock Python release build tools with uv (#56290)

## Why

Python release jobs installed build tools without a shared lockfile and allowed isolated builds to resolve additional dependencies. Release retries can also build older source revisions, so their tool pins need to come from the running workflow revision.

## What changed

- Add a shared setup action with pinned `uv` and locked `sdk` and `runtime` dependency groups. Apply a seven-day dependency age cutoff, with a two-day exception for `certifi` CA trust updates.
- Use the action for Python SDK and runtime packaging across Linux, macOS, and Windows. Build with `uv build --offline --no-build-isolation` using the prepared environments.
- In the standalone Python build workflows, check out the release tools from `github.workflow_sha` separately from the requested source revision.

GitOrigin-RevId: a9c0344930e5b9870ce9f7754a1fee1a9219305c

.github/actions/setup-python-release-tools/action.yml

@@ -0,0 +1,22 @@
+name: Set up Python release tools
+description: Install the locked wheel build tools for a Python SDK or runtime release.
+inputs:
+  group:
+    description: Dependency group to install (sdk or runtime).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      with:
+        version: "0.13.5"
+        enable-cache: false
+
+    - shell: bash
+      env:
+        RELEASE_TOOLS_GROUP: ${{ inputs.group }}
+        UV_PROJECT_ENVIRONMENT: ${{ runner.temp }}/python-${{ inputs.group }}-build-venv
+      run: |
+        uv sync --project "$GITHUB_ACTION_PATH" --locked --only-group "$RELEASE_TOOLS_GROUP" \
+          --no-build --no-python-downloads