Roll out reusable Pysa CI to active Python repos

[haasonsaas]

Summary

PR #87 adds the reusable Pysa workflow and starter template in evalops/.github. After that lands, roll it into the active Python repositories so Pysa becomes an actual PR gate rather than only an org template.

Active Python repos found on 2026-05-16

• evalops/deploy
• evalops/agent-pm
• evalops/nimbus
• evalops/mocktopus
• evalops/agent-harness
• evalops/orbit-agent
• evalops/evalops-anthropic
• evalops/evalops-openai
• evalops/cognitive-dissonance-dspy
• evalops/dspy-micro-agent
• evalops/bandit_dspy
• evalops/experiments
• evalops/dspy-0to1-guide
• evalops/dspy-advanced-prompting
• evalops/folie-a-deux-dspy
• evalops/gemini-exfil-detector
• evalops/override-cascade-dspy
• evalops/founder-email-optimizer

Acceptance criteria

• Each active Python repo has a PR workflow calling evalops/.github/.github/workflows/pysa.yml@main or an explicit documented exception.
• Repos with non-root Python source pass the correct working_directory and source_directories inputs.
• Repos with requirements or uv setup provide the correct install/setup command.
• At least one rollout PR includes a checked-in minimal model/config fixture so the Pysa lane proves it can surface findings.

References:

• https://pyre-check.org/docs/pysa-running/
• ci: add reusable Pysa workflow #87