ci: validate and publish native Python Rez packages

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           repository: vx-org/vx-rez-packages
-          ref: 8d54d7e1fd9f7281a20a9d40f8ef55aded2abd74
+          ref: 8ca39f087bee99307e9bd5f2b61b1915791df581
           path: tooling
           persist-credentials: false
       - uses: vx-org/vx@b2c1ce558af4b516261f34a27eb0576a9bec45f1

.github/workflows/native-release.yml

@@ -0,0 +1,19 @@
+name: Native Rez packages
+
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'python-*'
+      - '!python-*-pbs-*'
+
+permissions:
+  contents: write
+
+jobs:
+  native:
+    uses: vx-org/vx-rez-packages/.github/workflows/runtime-release.yml@8ca39f087bee99307e9bd5f2b61b1915791df581
+    with:
+      tooling-ref: 8ca39f087bee99307e9bd5f2b61b1915791df581
+      publish: ${{ github.event_name == 'push' }}

README.md

@@ -89,6 +89,8 @@ assets with an empty cache and successfully resolves and runs this package.
 
 ## Native validation
 
+The native workflow pins shared tooling commit `6f47843c52a77578fa7987188f73f7d751ce1b46` and builds every supported recipe target on its matching runner. Pull requests and manual runs verify bundles through public SDK 0.3.10 and adapter 0.1.1. Pushing the recipe's `python-3.7.9` tag also publishes the verified bundles and index, verifies every public asset, and repeats native acquisition from an empty cache and then offline. Historical PBS intake tags do not trigger this workflow.
+
 The native smoke checks the real interpreter, binary extension modules, bundled
 standard library, headers and link libraries, then creates and executes a fresh
 virtual environment. A separate VX consumer acceptance run must still verify