ci+test: Python quality baseline for the shared bridge (ruff + pytest), fix ActionEvent parser crash

[EslaM-X]

Summary

The Go side of the tunnel is now linted and unit-tested (#91, #92) — but the Python bridge had zero CI: no lint, no formatting, no unit tests. Any change to the shared zenoh_bridge could regress silently. This PR closes that gap with a minimal, green baseline — and fixes a real crash the new tests exposed.

---

What lands

pyproject.toml — ruff + pytest, scoped honestly

• ruff (E/F/I/UP/B/RUF, line-length 100, target-version py39) scoped to the pure-logic modules that are importable without a ROS 2 runtime.
• ROS 2 packages (isaac_sim_bridge, setup.py, launch/*.launch.py) and command_mapper.py (imports geometry_msgs) are deliberately excluded, so the baseline is green today and grows as new pure modules land.
• pytest pythonpath points at the pure package dir so the suite never imports ROS 2.

bridge/common/zenoh_bridge/tests/ — 22 unit tests

• test_action_event.py (15): valid envelopes, empty/missing payloads, params preservation, timestamp handling, malformed JSON, and non-object JSON ([], null, 42).
• test_utils.py (7): clamp bounds, inclusivity, negative bounds.

.github/workflows/python-quality.yml

ruff check + ruff format --check + pytest on every change touching bridge/common/zenoh_bridge/**, scripts/**, or pyproject.toml — with concurrency, timeout-minutes, least-privilege permissions, consistent with #91/#93.

Bug fix — parse_action_event crashed on non-object JSON

Valid-but-non-object JSON ([], null, 42) made json.loads succeed and then .get("payload") raise AttributeError inside the subscriber's hot path — violating the module's own documented contract "Returns None on parse failure". The parser now rejects any non-dict envelope. (Regression-proven by the new parametrized tests.)

---

Validation

• ✅ pytest -v: 22/22 pass (0.40s)
• ✅ ruff check . clean
• ✅ ruff format --check . clean
• ✅ The parser-crash tests fail on the old code and pass after the fix

Notes

• The lint scope is intentionally narrow today; include grows as bridges land. This keeps the very first baseline honest instead of force-formatting ROS 2 packages.
• Same workflow conventions as ci: harden Go workflows — official golangci-lint action, concurrency, path filters, single coverage pass, zenoh-c cache #91/docs+ci: add profile registry guide and permissive structure validator #93 (concurrency, timeouts, read-only permissions).

— EslaM-X 🇪🇬