Fix workflow race condition and sidecar path filter

- Add git pull --rebase before push in both version bump workflows to
  handle concurrent pushes from parallel workflows
- Add explicit python/ change detection in sidecar workflow (Gitea may
  not support paths filter), skip all jobs if no python changes
- Gate all sidecar build jobs on has_changes output

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -59,8 +59,9 @@ jobs:
           git commit -m "chore: bump version to ${NEW_VERSION} [skip ci]"
           git tag "v${NEW_VERSION}"
 
-          # Push using token for authentication
+          # Push using token for authentication (rebase in case another workflow pushed first)
           REMOTE_URL=$(git remote get-url origin | sed "s|://|://gitea-actions:${BUILD_TOKEN}@|")
+          git pull --rebase "${REMOTE_URL}" main || true
           git push "${REMOTE_URL}" HEAD:main
           git push "${REMOTE_URL}" "v${NEW_VERSION}"