Right now a red check on the Python-Unit job just says "failed" and
sends contributors to raw pytest logs to find out which test broke.
Add EnricoMi/publish-unit-test-result-action so failing tests get
annotated inline on the PR diff instead.
pytest already writes JUnit XML for free via --junit-xml; wire that up
for all three pytest invocations in the unit-tests job and upload it as
an artifact (uploaded even on failure, since that's exactly when it's
needed). A second workflow, triggered via workflow_run (same pattern
already used for the translation-regression bot), downloads that
artifact and publishes the check run. workflow_run always runs in the
base-branch context, so it can safely be granted checks:write even for
PRs from forks or Dependabot, without ever checking out untrusted PR
code.
Scoped to Python-Unit only for now; the frontend's 8-way jest shard and
the Python integration test matrix are natural follow-ups once this
pattern proves out.
2f0e3bce25