Python Service: Toolchain Consistency (uv/ruff/ty)

New Python services should use the default repo toolchain unless exception is explicitly documented.

Rationale:
- Consistent toolchains reduce maintenance overhead and keep CI behavior predictable.

Scope:
- PR review policy for new service roots under `domains/python/**`.

Trigger:
- A PR creates a new service root (new directory with Python project config plus executable service scripts/entrypoint).
- Existing service edits are out of scope unless they introduce a second dependency-manager stack.

Approval checks:
1) Dependencies are managed with `uv` and a committed `uv.lock`.
2) `script/lint` runs `ruff`.
3) `script/type_check` runs `ty`, or uses a documented approved replacement in service docs/PR rationale.
4) PR does not introduce mixed dependency-manager stacks in the same service without explicit migration plan.

Evidence:
- Diff shows service scripts/config and lockfile; any replacement/migration is documented with concrete ownership.

Exception path:
- Allow deviation only when all are true:
1) PR description includes `Policy Exception: python-toolchain-consistency`.
2) PR explains incompatibility with default stack.
3) PR documents migration/replacement controls preserving reproducibility.

Decision:
- Return NOT APPROVED when trigger is met and toolchain consistency checks fail without a valid exception.