ci: validate and publish Python runtime wheels

.github/workflows/ci.yml

@@ -143,6 +143,23 @@ jobs:
       - name: Run compatibility gates
         run: pnpm run check:node-compat
 
+  python-sdk:
+    runs-on: ubuntu-latest
+    name: python 3.10 / keyless SDK
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+          cache: pip
+
+      - name: Install uv
+        run: python -m pip install uv==0.11.23
+
+      - name: Run complete keyless Python suite
+        run: uv run --python 3.10 --group test --project python/sdk pytest
+
   # Single stable required check for branch protection: require "all checks
   # passed" instead of enumerating matrix legs whose names change as lanes and
   # node versions evolve. Every other job in THIS workflow must be listed in
@@ -154,7 +171,7 @@ jobs:
   all-checks-passed:
     name: all checks passed
     runs-on: ubuntu-latest
-    needs: [node-24, node-compat]
+    needs: [node-24, node-compat, python-sdk]
     if: always()
     steps:
       - name: Fail if any needed job did not succeed