CI paths: Conventions lane 1/8 — extract python-sdk #854

Part of #834. Phase 4, stack position 1 of 8. Blocked on #850.

What

paths: filters are workflow-scoped, not job-scoped, so per-lane triggering requires splitting conventions.yml into one file per lane. This slice extracts python-sdk.

Exact change

1. Create .github/workflows/conventions-python-sdk.yml:

name: Conventions (python-sdk)

on:
  pull_request:
    paths:
      - 'packages/python/dirsql/**'
      - 'packages/python/pyproject.toml'
      - 'packages/python/e2e-attestations/**'
      - 'packages/rust/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'testing-conventions.toml'
      - '.github/workflows/conventions-python-sdk.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  python-sdk:
    uses: thekevinscott/testing-conventions/.github/workflows/testing-conventions.yml@v0
    with:
      languages: '["python"]'
      source: packages/python/dirsql
      config: testing-conventions.toml
      base: ${{ github.event.pull_request.base.sha || 'origin/main' }}

2. Delete the python-sdk: job from .github/workflows/conventions.yml. Leave the other seven lanes and the file's on: / concurrency: / permissions: blocks untouched.

Two things that must not change

• The job id stays python-sdk. Check-run names are <caller job id> / <inner job name>; neither the workflow filename nor its name: appears in them. .mergify.yml anchors on ^python-sdk /, so renaming the job breaks the merge gate. The name: Conventions (python-sdk) above is cosmetic, for the Actions UI only.
• No push: trigger. conventions.yml is pull_request-only today; keep it that way.

Why these paths

Expected checks on this PR

Files touched: .github/workflows/conventions.yml, .github/workflows/conventions-python-sdk.yml.

MUST run — exactly these 8, nothing else

• python-sdk / … — from the new file (self-path)
• typescript-sdk / …, rust / …, rust-napi-binding / …, rust-python-binding / …, internals-checks / …, internals-distcheck / …, plugins-embeddings / … — the seven lanes still in the unconditional conventions.yml

MUST NOT run

• every test/lint/typecheck workflow (Python Test, TS Test, Rust Test, Plugins Test, Python Lint, Python Typecheck, TS Lint, TS Typecheck)
• Release Precheck, Release Config Check, Changelog Check — assuming CI paths: Release Precheck — stop running on every PR #851/CI paths: Release Config Check — stop running on every PR #852/CI paths: Changelog Check — stop running on every PR #853 have merged; if any has not, it still runs

The check count is unchanged from today (8 lanes) — the point of this PR is that one of them now comes from a filtered file. The count starts dropping at stack position 2.

Acceptance

• CI paths: Mergify — gate each anchor behind the files it covers #850 merged to main first
• Check list matches exactly, and python-sdk / … is present with its name unchanged
• Mergify Merge Protections green, Conventions python-sdk reported applied-and-satisfied
• Merge, close this issue

Notes

• Branch from main; the next lane slice stacks on this branch (base = this PR's head), since all eight edit conventions.yml and would otherwise conflict.
• No changelog fragment, no e2e attestation.