Add ci-python.yml shared workflow

[vnykmshr]

Parity with ci-go.yml / ci-node.yml. Reusable workflow for Python repos.

Suggested inputs:

• python-versions (default ["3.12", "3.13"])
• lint-python-version (default 3.13)
• package-manager (uv | pip | poetry, default uv)
• ruff-version (default latest)
• coverage-threshold (default 0)
• run-security (pip-audit, default true)
• run-secret-scan (gitleaks, default true)

Jobs: lint (ruff + mypy if configured), test (matrix), security, secrets.

First consumer: vnykmshr/setuaxis (currently inline ci.yml).