Publish Python packages after stable CLI releases (#44067)

## What changed

Add a downstream workflow that builds the Python SDK and runtime from the stable CLI release commit, using the CLI version for both packages and the SDK's exact runtime dependency. Publish and verify the runtime on PyPI before publishing the SDK.

Require a successful CLI `release` job, an unchanged release tag, and complete runtime assets. Skip CLI prereleases and allow publication despite unrelated publisher failures. Support retries by CLI workflow run ID and accept existing PyPI uploads while verifying the complete release.

Document release setup, retry procedures, and independent SDK releases.

## Testing

Add resolver unit tests covering tag resolution, prerelease skipping, partial reruns, pagination, invalid runs, moved tags, missing assets, and equivalent automatic and manual release resolution.

GitOrigin-RevId: 4ec6b2e77c94c851507dbe7200ea420994fce36e

.github/workflows/python-runtime-build.yml

@@ -3,6 +3,10 @@ name: python-runtime-build
 on:
   workflow_call:
     inputs:
+      source_ref:
+        description: "Source revision to build; defaults to the calling workflow revision."
+        required: false
+        type: string
       runtime_version:
         description: "Runtime version to build, for example 0.136.0, 0.136.0a2, or 0.136.0a2.post1."
         required: true
@@ -25,6 +29,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.source_ref || github.sha }}
           persist-credentials: false
 
       - name: Validate and resolve Python runtime release