feat(sdk): add the typed Python client

[SarthakWade]

What this changes

• Generates a zero-runtime-dependency typed Python SDK from the canonical protocol schema and fixtures.
• Provides synchronous and asynchronous local Unix-socket clients, capability negotiation, untrusted result wrappers, typed failures, and supervised host lifecycle ownership.
• Preserves platform launch defaults by omitting macOS presentation options unless explicitly requested.
• Hardens cancellation certainty, concurrent session closure, fork detachment, process reaping, bounded framing, and exact socket permissions.
• Adds exact wheel and sdist verification, isolated artifact installation tests, Linux and macOS Swift integration coverage, and reviewed PyPI trusted publishing.

Closes #165

Security and lifecycle

• No password parameter, TCP listener, remote control, arbitrary JavaScript, or Chromium debug port.
• Credential operations expose aliases and challenge identifiers only.
• Strict local socket location, owner, mode, framing, response ID, and protocol-version validation.
• Post-write uncertainty quarantines the affected session and prevents unsafe retries.
• Cancellation, timeout, fork, exception, and interpreter-exit paths close and reap only owned processes.
• Linux launch uses the platform-neutral supervised command; explicit presentation remains validated for macOS.

Verification

• Python generation check
• Ruff check and format check
• Strict mypy
• Pytest: 42/42
• Python 3.11 through 3.14 on macOS and Ubuntu
• Exact wheel and sdist build, content verification, isolated install, import, and pip check
• Real macOS Swift integration for sync and async clients
• Linux Docker E2E with real Python SDK integration
• pnpm test, pnpm test:runtime, and pnpm test:npm
• Web lint and production build
• Linux amd64 and arm64 release artifacts
• macOS and multi-platform container release artifacts
• Production dependency audit, action lint, shell syntax, and diff checks

Stack

This PR is based on #181, which is based on #180. Review against feat/typescript-sdk-164.

[yashranaway]

Python client matches the same contract: generated types, Unix-socket transport, 0700/0600 checks, supervised ownership, fork detach, and explicit capability failures. No password parameter, no TCP. Sync and async paths both close and reap owned processes.

Linux E2E and the Python matrix are green. Stacks on #181.