CI paths: Python Test — add internals/distcheck, exclude fragment/attestation dirs #847

Part of #834. Phase 1 (unanchored corrections — no dependency on any other slice).

What

Two defects in python-test.yml's filter:

1. Missing internals/distcheck/**. python-test.yml:210 runs dirsql-distcheck python, so this workflow is a consumer of that package, but a distcheck-only PR does not trigger it today. Spec row 9.
2. Over-triggers on packages/python/**. The glob pulls in changelog.d/, migrations.d/ and e2e-attestations/, none of which should run the test suite (spec rows 14 and 15).

Exact change

.github/workflows/python-test.yml — replace the on: block with:

on:
  push:
    branches: [main]
    paths:
      - 'packages/python/**'
      - '!packages/python/changelog.d/**'
      - '!packages/python/migrations.d/**'
      - '!packages/python/e2e-attestations/**'
      - 'packages/rust/**'
      - 'internals/distcheck/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/python-test.yml'
  pull_request:
    paths:
      - 'packages/python/**'
      - '!packages/python/changelog.d/**'
      - '!packages/python/migrations.d/**'
      - '!packages/python/e2e-attestations/**'
      - 'packages/rust/**'
      - 'internals/distcheck/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/python-test.yml'

Ordering matters. GitHub evaluates paths: patterns in order, last match wins, so the three ! exclusions must sit immediately after the packages/python/** they narrow and before the unrelated positives. Do not reorder them.

Do not add testing-conventions.toml — python unit coverage moved into the reusable testing-conventions workflow (python-test.yml:164), so this workflow no longer reads the root config.

Expected checks on this PR

Files touched: .github/workflows/python-test.yml only.

MUST run

• Python Test (self-path was already present)

MUST NOT run

• TS Test, Rust Test, Plugins Test, Python Lint, Python Typecheck, TS Lint, TS Typecheck

May still run (not yet filtered)

• Conventions (all 8 lanes), Release Precheck, Release Config Check, Changelog Check

Neither new behaviour (the distcheck glob, the exclusions) is exercised by this PR's own file list. Optional probe, recommended because the exclusions are the easiest thing to get wrong: push a throwaway commit touching internals/distcheck/README.md and packages/python/changelog.d/.gitkeep, confirm Python Test appears (distcheck glob works) — then a second throwaway commit touching only a packages/python/changelog.d/ file and confirm Python Test does not appear. Drop both commits before merging.

Acceptance

• The PR's check list matches the three groups above exactly
• Mergify Merge Protections green
• Merge, close this issue

Notes

• No changelog fragment, no e2e attestation. Not anchored in .mergify.yml.