Python: ci: validate dependency bounds for metadata changes

.github/workflows/python-code-quality.yml

@@ -82,6 +82,39 @@ jobs:
       - name: Run syntax and pyright across packages
         run: uv run poe check-packages
 
+  dependency-bounds:
+    name: Dependency Bounds
+    if: "!cancelled()"
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.13"
+      BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'origin/main' }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+      - name: Detect package metadata changes
+        id: package-metadata
+        shell: bash
+        run: |
+          if git diff --quiet "${BASE_REF}" HEAD -- 'python/pyproject.toml' 'python/packages/*/pyproject.toml'; then
+            echo "changed=false" >> "${GITHUB_OUTPUT}"
+          else
+            echo "changed=true" >> "${GITHUB_OUTPUT}"
+          fi
+      - name: Set up python and install the project
+        if: steps.package-metadata.outputs.changed == 'true'
+        uses: ./.github/actions/python-setup
+        with:
+          python-version: ${{ env.UV_PYTHON }}
+          os: ${{ runner.os }}
+        env:
+          UV_CACHE_DIR: /tmp/.uv-cache
+      - name: Validate dependency bounds for changed packages
+        if: steps.package-metadata.outputs.changed == 'true'
+        run: uv run poe validate-python-release --base-ref "${BASE_REF}"
+        working-directory: ./python
+
   samples-markdown:
     name: Samples & Markdown
     if: "!cancelled()"