Align default rendered SQL masking contract

[philipgreat]

Part of teaql/teaql-conformance#58: default expanded SQL diagnostics with field-aware masking across seven runtimes.

Python runtime changes keep original typed SQL bindings while projecting policy-aware default logs. Old generated descriptors without entity-level mask metadata fail closed even if an older property said plain; explicit empty metadata permits ordinary fields. Query comment/purpose in old generated requests are recovered when not explicitly set on the wrapper, and runtime-controlled warning/log outputs do not print private driver errors.

Evidence for this Python PR head 57874a8 (test-only successor to internal candidate source 735f800):

• Native masking/source contract and GitHub examples CI pass.
• Internal wheel 0.2.8+mask20260928.6 was built from predecessor 735f800, downloaded from the loopback Registry with identical SHA-256 and installed in an isolated venv.
• The unchanged old generated Order Management workspace ran repeatedly against SQLite; old missing metadata logs [REDACTED] while business results stay intact.
• Direct candidate provider tests on PostgreSQL/MySQL passed field-aware Q/Mutation and old-metadata fail-closed paths. Current generated workspaces on both providers passed generated Q, audited save, repeated EnsureSchema and safe logs. MySQL repeated EnsureSchema emits known “table already exists” driver warnings; no zero-warning result is claimed. Dedicated databases were removed.
• Official OpenTelemetry failure canary does not format the driver exception or export its message; local source suite with PYTHONPATH=src: 283 passed, 8 skipped.

Canonical evidence: release gate, Python .6 wheel, and current PostgreSQL/MySQL gates.

Remaining: final untested output-path review, online generator rollout, main merge and public PyPI publication. This PR remains draft; the internal wheel is not public.

Update 2026-09-29 — current draft HEAD 1bde439: PYTHONPATH=src suite: 284 passed, 8 skipped. A successful query remains successful when its diagnostic sink throws. The previous internal candidate was built from an earlier source commit and does not contain this production fix; rebuild and rerun the internal Registry candidate gate before treating current HEAD as release-qualified. Seven-language source gate: 7/7 PASS. Fail-open evidence.

Current-head artifact update: internal wheel 0.2.8+mask20260929.7 was built from 1bde439, byte-verified after Registry round-trip, and installed from the private PyPI index by a separate venv. The installed package passed 284 tests (8 skipped), including 37 SQL lifecycle tests. Temporary PATs were revoked. Exact candidate evidence. PostgreSQL/MySQL and newly generated workspaces still need .7 replays; earlier .6 results are historical, not .7 proof.

Update 2026-09-29 — current installed .7 wheel now passes an existing-generated PostgreSQL workspace upgrade replay (repeated schema ensure, generated audited Save/Q, original values, masked SQL), direct PostgreSQL provider new/legacy-metadata cases (2 passed), and a retained real PostgreSQL throwing-diagnostic-sink probe. The exact installed wheel version was asserted and dedicated databases were deleted. This is not yet a fresh-generator or MySQL .7 gate. Evidence and fixture: https://github.com/teaql/teaql-conformance/blob/docs/masking-release-gate-20260928/2026-09/202609290345-python-v7-postgres-generated-fail-open.md

[philipgreat]

Pre-merge conformance update:

• The branch is cleanly ahead of main with no missing main commits.
• All checks currently attached to this PR are green.
• The seven-runtime source gate passes 7/7.
• Fresh generated consumers for both displayName and display-name aliases pass SQLite Q, audited Mutation and masked-log replay across all seven languages.
• The merged generator is deployed publicly and its seven-language × 10-action Assist digest gate passes 70/70.
• HANA was not started; this is a source/main integration gate, not a public package release or HANA live-provider claim.

Canonical cross-language evidence:
https://github.com/teaql/teaql-conformance/blob/docs/masking-release-gate-20260928/2026-09/20260929-seven-language-combined-mask-consumers.md