ci: run Python SDK and sample regression tests

[arjun2075]

Description

The Python SDK tests (code/sdk/python/ap2/tests/) and the sample regression tests
(code/samples/python/tests/) are not currently executed by any GitHub Actions
workflow, so regressions in either suite are only caught when a contributor runs
pytest locally.

This PR adds a single Python 3.12 CI job that syncs the AP2 uv workspace once and
then runs both suites.

What this changes

• adds .github/workflows/python-tests.yml — one job, on pushes to main and pull
  requests targeting main
• syncs once with uv sync --all-packages, then runs both suites with
  uv run --no-sync so they reuse that environment instead of re-resolving per step

What this deliberately does not change

• no SDK, sample, or protocol behavior
• no dependency-locking policy change. AP2 currently has no committed uv.lock
  (removed in fix: remove uvlock #246), so the workflow resolves the workspace at run time, matching the
  repository's current setup. This PR does not reintroduce a lockfile.
• no paths: filter initially, so the check behaves predictably on every PR rather
  than depending on workflow-level path skipping. Straightforward to narrow if
  maintainers prefer lower CI usage.
• no Python version matrix. The project supports 3.11+; 3.12 keeps this first version
  small, and a minimum-supported-version matrix is a reasonable follow-up.

Workflow hardening

Third-party actions are pinned to immutable commit SHAs, persist-credentials: false
is set on checkout, workflow permissions are contents: read, and the job is bounded
with timeout-minutes: 15. These are defensive choices rather than an existing
repository-wide requirement.

Current status — draft

This is opened as a draft because the checks are expected to be red on the current
main baseline:

• code/samples/python/tests/ does not exist on main yet — it is added by fix(samples): fail closed in x402 PSP when agent-provider key is missing #310, so
  the sample step currently collects no tests.
• Two pre-existing SDK failures on main
  (kb_sd_jwt_intermediate_tests.py::test_verify_rejects_aud_mismatch and
  ::test_verify_rejects_nonce_mismatch) are addressed by fix(sdjwt): enforce aud/nonce binding on every KB hop, fail closed on terminal #313.

Local run on Python 3.12 against this branch: SDK suite 186 passed / 2 failed (the two
above), sample suite 0 collected. This PR intentionally does not modify kb_sd_jwt,
the failing tests, or #310 — it only adds the workflow. Once #310 and #313 land, this
branch will be rebased so the check can be evaluated against a green baseline.

The sample-test coverage motivation came out of the discussion on #310, which notes
that no CI job currently runs the sample pytest suite. This PR does not fix #310.

• Follow the CONTRIBUTING Guide.
• Make your Pull Request title in the https://www.conventionalcommits.org/ specification.
• Ensure the tests and linter pass — see "Current status" above; two pre-existing SDK failures (fix(sdjwt): enforce aud/nonce binding on every KB hop, fail closed on terminal #313) and the missing sample test directory (fix(samples): fail closed in x402 PSP when agent-provider key is missing #310) are expected on the current baseline.
• Appropriate docs were updated (if necessary) — N/A, CI-only change.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[giorgioroth]

Nice work, @arjun2075, clean scope, clean sequencing, and good call documenting the expected red baseline instead of mixing fixes into the CI PR.
I especially like that the workflow is being added as an observation mechanism, not allowed to redefine behavior just because it exposes existing failures. That keeps infrastructure, contract, and repair as three separate concerns. 👏

[arjun2075]

Thanks — really appreciate the review.

That separation was intentional: I wanted the CI change to make the existing contract visible without bundling in behavioral fixes just to get a green baseline.

Once #310 and #313 land, I’ll rebase onto main, rerun both Python suites, and update the draft with the resulting green baseline before marking it ready for review.