fix(release): tolerate PyPI index propagation delays - #33

Summary

Retry the release verification install when pip cannot yet find the exact qca-sdk version on the PyPI Simple index. Attempts are 30 seconds apart, capped at 21, with a 15-minute step timeout. Preserve each failure in the job log and stop immediately on other pip failures or version/import failures.

Why

In the 0.12.0 release, publication and PyPI JSON digest verification succeeded, but the Simple index still listed versions only through 0.11.0 when pip ran. The unchanged verification passed after propagation. This change handles that delay automatically without repeating publication or weakening artifact checks.

Incident: https://github.com/QoderAI/qoder-cloud-agents-sdk-python/actions/runs/40482438736/attempts/1

Verification

• uv run --no-sync make lint
• uv run --no-sync make typecheck
• uv run --no-sync make test — 3,977 passed; 73 account-backed cases deselected
• uv run --no-sync make docs-check
• Example --help smoke checks — not required; no example changes
• Account-backed integration tests run, or not required — not required for this CI-only change

Additional checks:

• uv run --no-sync make build passed.
• Release automation: 25 tests passed, including 6 new tests exercising the actual workflow shell step with controlled pip outcomes: immediate success, eventual availability, exhaustion, unrelated installation errors, import failure, and the configured timeout.
• Changelog validation, test-file Ruff checks, YAML parsing, shell syntax, and git diff --check passed.
• Executed the modified installation step against public PyPI qca-sdk 0.12.0 in a fresh temporary virtual environment; exact version and all four synchronous/asynchronous imports passed.
• Local validation used Python 3.12. GitHub CI will cover its configured version matrix.

Impact

• Public API or behavior changed
• User-facing changes added to CHANGELOG.md under Unreleased, or not applicable (explain below)
• Synchronous and asynchronous clients remain aligned
• Generated API documentation updated
• Contract fixtures updated
• Go and TypeScript parity considered
• Migration notes added for a breaking change
• No credentials, .env.live, logs, or generated test output committed

This is Python release automation only. SDK implementation, package version, public API documentation, fixtures, and runtime behavior are unchanged; no changelog entry or migration is needed. Go and TypeScript use different package registries and do not need this PyPI-specific fix. The existing 0.12.0 release is complete and does not need to be republished.