## Why
Python release jobs installed build tools without a shared lockfile and allowed isolated builds to resolve additional dependencies. Release retries can also build older source revisions, so their tool pins need to come from the running workflow revision.
## What changed
- Add a shared setup action with pinned `uv` and locked `sdk` and `runtime` dependency groups. Apply a seven-day dependency age cutoff, with a two-day exception for `certifi` CA trust updates.
- Use the action for Python SDK and runtime packaging across Linux, macOS, and Windows. Build with `uv build --offline --no-build-isolation` using the prepared environments.
- In the standalone Python build workflows, check out the release tools from `github.workflow_sha` separately from the requested source revision.
GitOrigin-RevId: a9c0344930e5b9870ce9f7754a1fee1a9219305c
