Phase A1: bootstrap Python ci_orchestrator package

- pyproject.toml (hatchling) with ruff/mypy/pytest dev deps
- src/ci_orchestrator/: config, credentials, backends (Protocol + WorkstationVmrunBackend), transport (WinRM via pypsrp, SSH via paramiko)
- CLI entry point with PoC 'wait-ready' subcommand (Windows + Linux guests)
- tests/python/: 35 unit tests, 83% coverage, all backends/transport mocked
- gitea/workflows/lint.yml: new 'python' job (ruff + mypy --strict + pytest --cov-fail-under=70)
- config.example.toml + README setup section + .gitignore Python entries

Neutral VmBackend Protocol prepared for Phase C ESXi extension.
See plans/implementation-plan-A-B.md step A1.

gitea/workflows/lint.yml

@@ -5,20 +5,26 @@
 # Failures block the PR. Fix warnings with:
 #   Invoke-ScriptAnalyzer -Path scripts\ -Recurse -Fix
 
-name: Lint (PSScriptAnalyzer)
+name: Lint
 
 on:
   push:
     paths:
       - '**.ps1'
       - '**.psm1'
+      - '**.py'
+      - 'pyproject.toml'
+      - 'gitea/workflows/lint.yml'
   pull_request:
     paths:
       - '**.ps1'
       - '**.psm1'
+      - '**.py'
+      - 'pyproject.toml'
+      - 'gitea/workflows/lint.yml'
 
 jobs:
-  lint:
+  pssa:
     runs-on: windows-build
     timeout-minutes: 10
 
@@ -53,3 +59,55 @@ jobs:
           else {
             Write-Host "PSScriptAnalyzer: no issues found."
           }
+
+  python:
+    runs-on: windows-build
+    timeout-minutes: 15
+
+    env:
+      PYTHONIOENCODING: utf-8
+      VENV_DIR: F:\CI\python\venv
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Setup venv + install package
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $py = (Get-Command python -ErrorAction Stop).Source
+          if (-not (Test-Path "$env:VENV_DIR\Scripts\python.exe")) {
+            Write-Host "Creating venv at $env:VENV_DIR"
+            & $py -m venv $env:VENV_DIR
+            if ($LASTEXITCODE -ne 0) { throw "venv creation failed" }
+          }
+          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
+          & $venvPy -m pip install --upgrade pip
+          if ($LASTEXITCODE -ne 0) { throw "pip upgrade failed" }
+          & $venvPy -m pip install -e ".[dev]"
+          if ($LASTEXITCODE -ne 0) { throw "pip install failed" }
+
+      - name: ruff
+        shell: powershell
+        run: |
+          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
+          & $venvPy -m ruff check src tests/python
+          if ($LASTEXITCODE -ne 0) { throw "ruff failed" }
+
+      - name: mypy --strict
+        shell: powershell
+        run: |
+          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
+          & $venvPy -m mypy --strict src
+          if ($LASTEXITCODE -ne 0) { throw "mypy failed" }
+
+      - name: pytest (coverage >= 70%)
+        shell: powershell
+        run: |
+          $venvPy = Join-Path $env:VENV_DIR 'Scripts\python.exe'
+          & $venvPy -m pytest tests/python --cov=ci_orchestrator --cov-fail-under=70
+          if ($LASTEXITCODE -ne 0) { throw "pytest failed" }