ci: validate and publish Python runtime wheels

.github/workflows/build-exe-for-python-sdk.yml

@@ -119,6 +119,13 @@ jobs:
         with:
           node-version: 24
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Install Python build tooling
+        run: python -m pip install uv==0.11.23
+
       - name: Enable corepack (pnpm)
         run: corepack enable
 
@@ -156,6 +163,78 @@ jobs:
       - name: Build single-exe
         run: pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
 
+      - name: Resolve platform artifact names
+        id: runtime
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+          platform="${TARGET#node24-}"
+          exe="$PWD/dist-exe/dsh-jsonrpc-agent-pkg-$platform"
+          [ -x "$exe" ] || { echo "::error::$exe missing or not executable"; exit 1; }
+          echo "platform=$platform" >> "$GITHUB_OUTPUT"
+          echo "exe=$exe" >> "$GITHUB_OUTPUT"
+
+      - name: Full-turn SDK, custom cordis, and direct-binary smoke
+        run: >-
+          uv run --python 3.10 --group test --project python/sdk
+          python scripts/smoke-python-runtime.py
+          --scenario all
+          --exe "${{ steps.runtime.outputs.exe }}"
+
+      - name: Build release-shaped SDK and runtime wheels
+        run: |
+          set -euo pipefail
+          python scripts/build-python-release.py \
+            --package sdk \
+            --tag python-v0.0.0 \
+            --output-dir dist-python
+          python scripts/build-python-release.py \
+            --package runtime \
+            --tag python-v0.0.0 \
+            --platform "${{ steps.runtime.outputs.platform }}" \
+            --runtime-exe "${{ steps.runtime.outputs.exe }}" \
+            --output-dir dist-python
+
+      - name: Install only the SDK into a clean venv and run zero-config
+        run: |
+          set -euo pipefail
+          python -m venv "$RUNNER_TEMP/dsh-sdk-smoke"
+          "$RUNNER_TEMP/dsh-sdk-smoke/bin/python" -m pip install \
+            --find-links dist-python \
+            deepseek-harness==0.0.0
+          "$RUNNER_TEMP/dsh-sdk-smoke/bin/python" scripts/smoke-python-runtime.py \
+            --scenario sdk-default
+
+      - name: Check Linux GLIBC requirements
+        if: runner.os == 'Linux'
+        run: |
+          set -euo pipefail
+          readelf --version-info "${{ steps.runtime.outputs.exe }}" | tee glibc-versions.txt
+          maximum="$(sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' glibc-versions.txt | sort -V | tail -1)"
+          [ -n "$maximum" ] || { echo "::error::No GLIBC requirements found"; exit 1; }
+          dpkg --compare-versions "$maximum" le 2.28 || {
+            echo "::error::Executable requires GLIBC_$maximum but wheel claims manylinux_2_28"
+            exit 1
+          }
+
+      - name: Run wheel in a manylinux 2.28 container
+        if: runner.os == 'Linux'
+        env:
+          RUNNER_ARCH: ${{ runner.arch }}
+        run: |
+          set -euo pipefail
+          case "$RUNNER_ARCH" in
+            X64) image=quay.io/pypa/manylinux_2_28_x86_64 ;;
+            ARM64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
+            *) echo "::error::Unsupported Linux runner architecture $RUNNER_ARCH"; exit 1 ;;
+          esac
+          docker run --rm -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c '
+            /opt/python/cp310-cp310/bin/python -m venv /tmp/dsh-sdk
+            /tmp/dsh-sdk/bin/python -m pip install --find-links /work/dist-python deepseek-harness==0.0.0
+            /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-default
+          '
+
       # The bare exe ships inside a tar.gz (the mode-preservation note in
       # the header): uploading dist-exe/ bare would hand consumers a 0644
       # file that subprocess.Popen refuses to run.
@@ -223,3 +302,9 @@ jobs:
           name: deepseek-harness-python-${{ matrix.target }}
           path: ${{ steps.pack.outputs.bundle }}
           if-no-files-found: error
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: deepseek-harness-wheels-${{ matrix.target }}
+          path: dist-python/*.whl
+          if-no-files-found: error