feat(security): land Engram 10/10 wave 4 foundations

.github/workflows/ci.yml

@@ -118,6 +118,14 @@ jobs:
     needs: [fmt, clippy, security-gate]
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+      - name: Enforce retrieval and performance budgets
+        run: >-
+          python3 scripts/check-quality-budgets.py
+          --budgets docs/quality/budgets.json
+          --retrieval tests/fixtures/retrieval_quality/baseline.json
+          --criterion benches/results/benchmark_results.txt
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable 2026-07-12
         with:
           targets: wasm32-unknown-unknown
@@ -504,7 +512,7 @@ jobs:
   bench:
     name: Benchmark Regression Check
     runs-on: ubuntu-latest
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: github.event_name == 'pull_request' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: write
       pull-requests: write
@@ -513,15 +521,22 @@ jobs:
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable 2026-07-12
       - uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
 
-      - name: Run benchmarks (Criterion JSON output)
-        run: cargo bench -- --output-format bencher | tee bench-output.txt
+      - name: Run benchmarks (Criterion bencher output)
+        shell: bash
+        run: |
+          set -o pipefail
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            cargo bench --bench entity_extraction -- --output-format bencher
+          else
+            cargo bench -- --output-format bencher
+          fi | tee bench-output.txt
 
       - name: Store benchmark results
         uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1
         # Tolerate missing gh-pages branch on first run / forks. The raw
         # criterion artifacts still upload via the next step, so PR authors
         # can inspect benchmark output even before history is established.
-        continue-on-error: true
+        continue-on-error: ${{ github.event_name != 'pull_request' }}
         with:
           name: Engram Performance
           tool: cargo

.github/workflows/python-sdk-live.yml

@@ -0,0 +1,46 @@
+name: Python SDK Live
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'sdks/python/**'
+      - 'scripts/test-python-sdk-live.sh'
+      - '.github/workflows/python-sdk-live.yml'
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+  push:
+    branches: [main]
+    paths:
+      - 'sdks/python/**'
+      - 'scripts/test-python-sdk-live.sh'
+      - '.github/workflows/python-sdk-live.yml'
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live-package-contract:
+    name: Python SDK installed-wheel live contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable 2026-07-12
+      - name: Install native build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler python3-venv
+      - name: Run installed-wheel live contract
+        run: bash scripts/test-python-sdk-live.sh
+      - name: Run Python SDK unit suite
+        run: |
+          python3 -m venv .python-sdk-unit
+          .python-sdk-unit/bin/python -m pip install --quiet --upgrade pip
+          .python-sdk-unit/bin/python -m pip install --quiet -e 'sdks/python[dev]'
+          .python-sdk-unit/bin/python -m pytest sdks/python/tests -q