feat(coverage): add bounded PyO3 peer-evidence gate

[seonghobae]

Buyer-visible blocker

Central OpenCode coverage currently fails before pytest collection in mature maturin/PyO3 packages when the isolated source-only sandbox cannot import the compiled native extension. This leaves otherwise verified Python-only product PRs blocked even when the exact head passes repository Python, Rust/PyO3, package, GPU, and fuzz jobs.

This bounded slice

• add scripts/ci/python_native_extension_peer_gate.py;
• require exact maturin + PyO3 metadata and the declared dotted module-name;
• classify only complete pytest collection failures caused exclusively by that declared native module being absent;
• reject mixed imports, test failures, setup/teardown errors, pytest internal errors, crashes, truncation, malformed input, and unsafe paths;
• refuse deferral when Rust, Cargo, native crate, native stub, packaging, dependency lock, requirements, GitHub workflow/action, or maturin metadata changes;
• verify trusted CheckRun records by exact head SHA, workflow, check name, completed state, and success conclusion;
• reject pending, failed, stale-head, status-only, lookalike, missing, duplicate-requirement, or malformed evidence;
• add APA 7 doctoring and authoritative changelog material.

Verification

Focused local verification on the published source:

81 tests passed
220/220 production statements covered
98/98 production branches covered
Python compilation succeeded

The tests include the exact fast_mlsirm._core failure shape and adversarial native-boundary, filesystem, log, metadata, and check-evidence cases.

Security boundary

This PR does not skip tests, build a PR-selected extension, enable network access, add a Python compatibility stub, approve a pull request, or weaken branch protection. A successful classification is explicitly not passing evidence; the final central workflow must still prove trusted exact-head Python, Rust/PyO3, and package checks.

Remaining integration

Keep this PR Draft. A follow-up commit in this PR must wire the helper into the central coverage and approval workflow, add the permanent workflow contracts, and re-run fast-mlsirm#546 on its exact current head. Until that integration is reviewed, the current fail-closed coverage behavior remains authoritative.

Advances #784.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cd75224-236f-4fdb-b4be-fe45f660ce01

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}