Implement Python build type

[TomHennen]

Summary

Implements the Python build type spec from #151. Three-job architecture with minimal permissions on the build step, PEP 740 attestations on publish, and SLSA L3 provenance.

Files

File	Purpose
build/actions/python/action.yml	Composite action: validate, detect uv, install deps, test, build, SBOM, hash
.github/workflows/build_and_publish_python.yml	Reusable workflow: build → publish → provenance
build/actions/python/test.bats	19 structural tests
gh_workflow_examples/build_python.yml	Adopter example workflow

Manual steps required before end-to-end testing

1. Create a test package on TestPyPI — register wrangle-test-fixture (or similar) at https://test.pypi.org
2. Configure Trusted Publisher on TestPyPI — project settings → Publishing → add GitHub. Specify:
   • Repository: TomHennen/wrangle-test
   • Workflow: test-wrangle.yml (the generated workflow on integration branches)
3. Add Python fixture to companion repo (tomhennen/wrangle-test):

   python/
   ├── pyproject.toml      # minimal project, hatchling backend
   ├── src/example/__init__.py
   └── tests/test_example.py
   

4. Update companion template — add test-python job pointing at build_and_publish_python.yml with repository-url: https://test.pypi.org/legacy/
5. After merging: update the hardcoded SHA in build_and_publish_python.yml to include the composite action (one-commit-lag, same as other build types)

What this PR does NOT include

• Companion repo fixture (step 3-4 above — separate PR on wrangle-test)
• TestPyPI Trusted Publisher config (manual, step 1-2)
• End-to-end integration test verification (requires the above)

Test plan

• ./test.sh passes (164 tests — 19 new)
• End-to-end: requires companion repo setup (follow-up)

🤖 Generated with Claude Code

[TomHennen]

Integration test results

Almost everything works — major progress:

Job	Result
test-shell	✅
test-scan	✅
test-container (build + provenance)	✅
test-python / build	✅
test-python / provenance (SLSA L3)	✅
test-python / publish	❌

Publish failure: PyPI Trusted Publishing does not support reusable workflows

The claims in this token suggest that the calling workflow is a reusable workflow.
Reusable workflows are **not currently supported** by PyPI's Trusted Publishing

PyPI's OIDC token validation rejects tokens from reusable workflows — the claims differ from direct workflows. This means pypa/gh-action-pypi-publish cannot run inside wrangle's reusable workflow with Trusted Publishing.

This is a fundamental architectural constraint: the publish step cannot live inside the reusable workflow. It needs to run directly in the adopter's workflow, or PyPI needs to add reusable workflow support.

Investigating options.