feat: python test, lint and policy check workflows

[lengau]

This adds three workflows:

• Python tests
• Python linters
• Policy check

These are detailed in README.md

Sample usage:

• ci: use starflow policy and QA workflows craft-platforms#60
• ci: use starflow CI actions starbase#272

Intentional failures:

• Lint and test: https://github.com/canonical/craft-platforms/actions/runs/11486010955/job/31967372207?pr=60
• Conventional Commits: https://github.com/canonical/craft-platforms/actions/runs/11486010960/job/31967373383?pr=60

[lengau]

Re-requesting review from @tigarmo and @sergiusens given the changes made.

[tigarmo]

don't we need to further restrict these to amd64?

[lengau]

We can and we needn't. I added the architectures in the self-test in order to check that we could add lists of tags, but I figured here it would be a good default to simply run the tests on the first available runner regardless of architecture.

[upils]

Based on the errors in https://github.com/canonical/starflow/actions/runs/11824136927 I think the conversion back to a JSON is giving an invalid cache key.

We could try with:

Suggested change

	cache-suffix: ${{ toJSON(matrix.platform) }}
	cache-suffix: ${{ matrix.platform }}

[lengau]

The path doesn't exist because we're not actually using uv in those tests. This needs to be toJSON so it's a string - otherwise it fails when you have an array of tags (e.g. your platform is our self-hosted [noble, amd64]).

[upils]

I meant that it looks like this is resolving to an invalid value:

[lengau]

Ahh, I see. Thank you! Fixed :-)

[upils]

LGTM. But I still have a small concern about the cache keys names, see #18 (comment)