python: CI for the workspace — pure tests on 3.9 and 3.14, six wheels #1383

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 2 of 14.

What to build

A pull request touching the Python workspace gets a green or red check without anyone running anything by hand. A new root workflow tests-python.yml runs cargo fmt --check, clippy, cargo test --locked for the two crates, and the pure-Python pytest suite on Python 3.9 and 3.14. A second job builds a wheel for each of the six platforms the FFI already ships for (linux x64 gnu, linux arm64 gnu, macOS x64, macOS arm64, windows x64, and the sixth from the protect-ffi matrix) with abi3-py39, uploads them as artifacts, and records build time per platform in the job summary.

The live test job (credentials, Postgres) is NOT in this ticket; it lands with the first encrypt ticket.

Acceptance criteria

• tests-python.yml runs on pull requests that touch the Python workspace, the shared stack crates, or the EQL codegen, and on every push to main.
• Both Python versions pass the pytest suite; both show in the matrix.
• Six wheels are produced and attached as artifacts; the job summary shows build time per wheel.
• Swatinem/rust-cache is used on every job that compiles Rust, consistent with the existing CI linters.
• The repo's CI meta-tests (scripts/__tests__/*) pass with the new workflow present; add the workflow to any allowlist they require, with a written reason.
• No job in this workflow receives CS_* credentials.