Python: ci: validate dependency bounds for metadata changes - #7476

Motivation & Context

Python package dependency bounds are validated by weekly maintenance, but a broken floor or ceiling can still merge before that schedule catches it. The repository now has a bounded validate-python-release task that probes only changed package metadata and its affected package closure, but no CI workflow invokes it.

This closes the enforcement gap without putting the exhaustive workspace matrix on every Python PR, matching the cost concern discussed in #6582.

Description & Review Guide

• What are the major changes? Add a blocking Dependency Bounds job to the existing Python Code Quality workflow. It resolves the immutable PR/merge-group base, detects changes to published package pyproject.toml files, and conditionally runs validate-python-release against that base.
• What is the impact of these changes? Package metadata changes are tested at their lower and upper dependency resolutions before merge. Ordinary Python code changes pay only for checkout plus git diff; project setup and validation are skipped.
• What do you want reviewers to focus on? Please verify the event-specific base-ref fallback and whether package manifests are the desired trigger boundary. The exhaustive test+typing bounds matrix remains in weekly dependency maintenance.

Related Issue

Fixes #6582

Validation

• actionlint .github/workflows/python-code-quality.yml
• YAML parse and git diff --check
• Change detector: current workflow-only diff skips; a historical package-manifest commit triggers
• Release validator dry-run: 76 lower/upper probes across 38 affected packages completed successfully

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible — not run for this workflow-only change; the workflow lint, detector branches, and validator dry-run are covered above
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.