ci: add Python reference seller interop gate

[bokelley]

Summary

• add a reusable Python reference seller interop workflow for TS candidates
• wire release publishing to depend on the Python interop gate
• pin the Python harness to adcp-client-python@v6.1.0-beta.2, the first known-good tag with the 3.1 reference seller fix
• allow prerelease schema cache directories in schemas:ensure so 3.1.0-beta.3 cache satisfies local/CI builds

Closes #1916.

Validation

• npx prettier --check .github/workflows/interop-python.yml .github/workflows/release.yml .changeset/python-reference-seller-interop.md scripts/schemas-ensure.ts
• YAML parse for .github/workflows/interop-python.yml and .github/workflows/release.yml
• npm run build:lib
• local cross-repo harness using packed @adcp/sdk@8.1.0-beta.8 + adcp-client-python@v6.1.0-beta.2: Status: passing, 88 passed / 0 failed / 2 skipped, controller_detected: true
• pre-push hook: npm run typecheck, library build

[aao-ipr-bot]

Approving. Right shape: fail-closed gate on release publishing, pinned, with a pre-flight existence check that names the upstream PR you need.

Things I checked

• release.yml adds python-interop as a sibling job and the release job carries needs: python-interop. Fail-closed beats fail-open — a broken Python interop now blocks npm publish.
• Harness pinned to v6.1.0-beta.2, the first known-good tag with the 3.1 reference seller fix; the workflow errors with a pointer to adcontextprotocol/adcp-client-python#818 if a future ref override drops the harness script (interop-python.yml:84-89).
• permissions: contents: read is the floor. No write scopes.
• set -euo pipefail on every inline shell step, plus the tarball-count guard at interop-python.yml:53-58 — if npm pack ever produces more than one tarball, we error instead of silently picking one.
• Storyboard artifacts upload with if: always() and if-no-files-found: ignore so a harness crash still yields the seller log.
• Empty-frontmatter changeset matches the established no-bump pattern in this repo (e.g. .changeset/cluster-3-schema-validation-sweep.md). CLAUDE.md explicitly excludes .github/workflows/ from the changeset requirement; the file is there purely as a changelog note.
• The new Python reference seller check already runs green on this PR — the gate validates itself.

Follow-ups (non-blocking — file as issues)

• Tag pin (v6.1.0-beta.2) vs commit-SHA pin: tags are mutable upstream. SHA pinning would harden against a force-moved tag at the cost of legibility. Not urgent — same-org repo — but worth a follow-up.
• The default ref v6.1.0-beta.2 is repeated three times (workflow_dispatch.inputs.default, workflow_call.inputs.default, and the inputs.python_ref || 'v6.1.0-beta.2' env fallback for pull_request triggers). Pulling it into a single env constant at workflow scope would prevent drift when the pin bumps.

Minor nits (non-blocking)

1. PR description overstates the diff. The bullet about scripts/schemas-ensure.ts accepting prerelease cache directories doesn't appear in this diff — the merge commit 99a0dea1 resolved a conflict by taking what main already had. Not a code problem, but the PR body reads as if four things ship here when three do.

Safe to merge.