ci(test-unit-python): migrate python-sdk unit tests to Depot runners

Depot Startup plan (unlimited minutes) for consistent runner quality
across unit-test workflows. Extends the pattern from PR CopilotKit#4018.

Also adds the id-token: write permission required for Depot OIDC
auth, alongside contents: read for least-privilege defaults.

Author: jpr5

.github/workflows/test_unit-python-sdk.yml

@@ -12,13 +12,19 @@ on:
       - "sdk-python/**"
       - ".github/workflows/test_unit-python-sdk.yml"
 
+# Least-privilege by default. Individual jobs/steps can widen when needed.
+# id-token: write is required for Depot OIDC auth (runs-on: depot-ubuntu-*).
+permissions:
+  contents: read
+  id-token: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4