fix(cic): narrow workflow.on before Object.keys in python-release assertion

Guard workflow.on with isRecord before Object.keys to satisfy TS2769.

scripts/ci-workflow.spec.ts

@@ -288,6 +288,7 @@ describe('Python release workflows', () => {
     }
 
     expect(dispatch.inputs.publish).toMatchObject({ type: 'boolean', default: false })
+    if (!isRecord(workflow.on)) throw new TypeError('python-release workflow must define on')
     expect(Object.keys(workflow.on)).toEqual(['workflow_dispatch'])
     expect(build).toMatchObject({
       if: "github.event_name == 'workflow_dispatch'",