fix(python-checks): don't fail private-index probe on expected 404 at bare /simple/ root

Gitea's PyPI registry only resolves /simple/<package>/, not the bare
/simple/ index root, so the v1.11.2 probe added to give visible
diagnostics for the private-index setup step was always 404ing even
when the index and credentials were correct. This broke installs of
private Python packages during builds. The probe now only fails hard
on 401/403 (auth rejected) or an unreachable host; a plain 404 is
logged and left to pip's own resolution to confirm.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/python-checks.yml

@@ -60,6 +60,12 @@ jobs:
 
           # Probe the configured simple index before pip resolves dependencies.  The
           # probe deliberately prints only scheme/host/path, never URL credentials.
+          # NOTE: Gitea's PyPI package registry does not serve a browsable listing at
+          # the bare /simple/ root (only /simple/<package>/ resolves per PEP 503), so a
+          # 404 against the configured URL is expected there and is not itself a fault.
+          # This probe therefore only fails hard on auth rejection (401/403) or an
+          # unreachable/erroring host; a plain 404 is logged and deferred to pip's own
+          # resolution, which is the real signal for whether the package is installable.
           python - "$PRIVATE_INDEX_URL" <<'PY'
           import base64
           import sys
@@ -84,6 +90,15 @@ jobs:
               if error.code in {401, 403}:
                   print("Authentication was rejected by the private package index.")
                   raise SystemExit(1)
+              if error.code == 404:
+                  print(
+                      "Bare index root returned 404; Gitea's PyPI registry does not "
+                      "serve a listing at /simple/ (only /simple/<package>/ resolves "
+                      "per PEP 503). Treating this as expected and deferring to pip's "
+                      "own dependency resolution to confirm the index actually works."
+                  )
+              else:
+                  raise SystemExit(1)
           except URLError as error:
               print(f"Private package-index probe could not reach {safe_url}: {error.reason}")
               raise SystemExit(1)