python: generated EQL v4 markers from the catalog #1385

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 4 of 14.

What to build

stackencrypt.TextEq.sql_domain answers public.eql_v4_text_eq and stackencrypt.TextEq.query_sql_domain answers eql_v4.query_text_eq, and the same holds for every producible EQL v4 type, from a committed generated module. A new eql-codegen emitter beside the Go one writes it from the shared catalog rows.

Each generated marker carries the ten attributes the spec names: name, family, suffix, plaintext kind, sql_domain, indexes, query, query_sql_domain, producible (a literal), reason. A TYPES tuple lists them all. Unproducible markers exist in the generated module but are not re-exported from the package. A Marker base class and the two hand-written markers Passthrough and Ignore live beside it.

Acceptance criteria

• mise run types:generate in the EQL subtree writes the Python module; types:check fails when it drifts.
• A parity test in eql-codegen compares the Python output's rows against the Go output's rows: same names, same producible flags, same plaintext kinds (11 unproducible rows on both sides today).
• The EQL workflow path filters include the generated Python module's path, and the filter-derivation test passes.
• from stackencrypt import TextEq, Text, Passthrough, Ignore works; importing an unproducible marker from the package fails with ImportError.
• pytest asserts the ten attributes on TextEq and that TYPES matches the catalog count.