feat: add ChromaDB retrieval filtering example

[rlippmann]

Summary

Adds a Python ChromaDB retrieval-filtering example using the HR policy lookup domain.

The example demonstrates host-side retrieval filtering where Context Compiler authoritative state determines which documents are eligible before retrieval results are returned.

Why

Retrieval filtering is an important enforcement point because authorization and eligibility decisions should occur before documents are returned to downstream systems.

This example shows how a retrieval layer can use authoritative Context Compiler state to constrain retrieval results rather than relying on prompt instructions or post-generation filtering.

Example metadata

• Enforcement point: retrieval filtering
• Domain: HR policy lookup
• Technology/runtime: ChromaDB
• Example type: technology-specific integration example
• Does this use directive drafter? should normally be no: no
• Does this derive state from model output? must be no for primary examples: no

Checklist

• Repository scaffolding / governance change
• One primary enforcement point
• Explicit authoritative state
• No model-derived state mutation
• Adversarial stub or equivalent test
• Observable runtime behavior change
• Domain vocabulary is natural
• Framework is secondary to the enforcement point
• Docs updated
• Tests/smoke checks added where practical

Notes

The example demonstrates:

• Context Compiler state determines eligible document audiences.
• The host applies eligibility constraints before retrieval results are returned.
• Different authoritative states produce different retrieval result sets.
• Unauthorized documents are never returned by the retriever.
• Adversarial request text does not change retrieval eligibility.
• Contradictory directives produce clarification behavior rather than silent overwrite.

This example intentionally uses the direct ChromaDB Python client rather than a higher-level retrieval framework so the enforcement boundary remains explicit and easy to inspect.

No TypeScript technology-specific retrieval example is included in this PR. The existing generic TypeScript retrieval-filtering example remains the TypeScript baseline. A TypeScript-native retrieval technology can be evaluated independently in a future PR.

Validation

• Focused ChromaDB retrieval-filtering tests passed
• Canonical Python validation passed
• No TypeScript changes included in this PR