feat(sdk): publish Python + Go verdict-consumption SDKs

[trilamsr]

Summary

Closes v1-rc1 cut criterion 12 — publishes the Python + Go client SDKs operators bind against to decode tracecore-emitted verdicts.

• Go SDK at module/sdk/verdict/ — Decode(rawJSON []byte) (*Verdict, error) validates against the embedded v1.0-rc1 envelope schema and returns a typed Verdict with per-pattern extensions on Verdict.Extras.
• Python SDK at python/tracecore_verdict/ — decode(raw_json: bytes | str) -> Verdict validates via jsonschema and returns a typed dataclass with per-pattern extensions on Verdict.extras. Pip-installable as tracecore-verdict.
• Single source of truth: both SDKs ship a byte-identical copy of docs/schemas/verdict-1.0.0-rc1.json (Go via //go:embed, Python via package-data). A drift-detection test in each SDK fails the build if the copy strays from canonical.
• CI gate: new sdk-python job wired into the verify aggregator; Go SDK already runs via verify-test through go.work resolution.
• Docs: docs/sdk/README.md indexes both SDKs + version policy; cross-linked from docs/README.md; criterion 12 flipped from ☐ to ☑.

Install

# Python
pip install tracecore-verdict

# Go
go get github.com/tracecoreai/tracecore/module/sdk/verdict

Discipline

• TDD: RED commits (test(sdk/verdict): RED ..., test(tracecore_verdict): RED ...) precede GREEN. Tests assert: happy-path decode, schema-invalid rejection (6 envelope guards), malformed JSON rejection, per-pattern extras preserved, all 8 shipped patterns round-trip, missing-layers populated.
• Schema pin: per-SDK TestEmbeddedSchemaMatchesCanonical / test_embedded_schema_matches_canonical byte-compares the embedded schema against docs/schemas/verdict-1.0.0-rc1.json. Drift fails the build with a copy-paste fix hint.
• Versioning: both SDKs target schema v1.0-rc1 only. A future envelope ships a new sibling package (module/sdk/verdict/v2, tracecore-verdict-v2) — never a silent breaking change.

### Added
- Python verdict-consumption SDK (`tracecore-verdict`, `pip install tracecore-verdict`) — typed dataclass + `decode()` for v1.0-rc1 envelopes. Closes v1-rc1 cut criterion 12 (Python half).
- Go verdict-consumption SDK (`module/sdk/verdict`, `go get github.com/tracecoreai/tracecore/module/sdk/verdict`) — typed `Verdict` + `Decode()` for v1.0-rc1 envelopes. Closes v1-rc1 cut criterion 12 (Go half).
- SDK landing page at `docs/sdk/README.md` with version policy + per-pattern field inventory.

### CI
- New `sdk-python` workflow job (pytest) wired into the `verify` aggregator.

Test plan

• go test -race ./module/sdk/verdict/... clean
• cd python/tracecore_verdict && pytest — 21/21 pass
• cd python/tracecore_verdict && make test — pass
• go vet ./... clean
• make tidy-check / make license-check / make actionlint / make doc-check clean
• make zizmor clean
• CI green on PR

[trilamsr]

Addressed reviewer findings:

🔴 Fixed (real bug): added hw_gpu_sdc + gen_ai_training_eval_accuracy evidence kinds to all three schema copies (canonical + Go SDK + Python SDK). SDC verdicts (pattern #13) now validate.

🟡 Fixed: drift tests now JSON-normalize (Go: json.Unmarshal + require.Equal; Python: json.loads + dict compare) — whitespace-only canonical reformatting won't false-positive.

🔵 Fixed: 9th SDC fixture added to both Go + Python round-trip suites. docs/sdk/README.md updated to '9 shipped pattern verdicts'.

Acknowledged: future patterns still require manual fixture sync across Go + Python — tracked as code-gen opportunity, not blocking rc1.