python: declaration meaning — type table, hints, engine check, constructor #1387

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 6 of 14.

What to build

The declaration from the previous ticket is now checked for meaning, still at the class statement. The annotation's Python type must be exactly the marker kind's type from the spec's table (TextEq → str, Int64 → int, and so on); Passthrough accepts only the eight listed Python types. Forward references are resolved with get_type_hints(include_extras=True) over the class and its bases; a reference that does not resolve is refused. An unproducible marker is refused. The plan is handed to the engine's plan_with through the extension so the engine sees the same declaration a Rust caller would, and the engine's refusal becomes a DeclarationError. The constructor is checked: every plan field must be a constructor parameter, and every Ignore field must be omittable (default or factory) because decrypt never passes it.

Codes: DECLARATION_TYPE_MISMATCH, DECLARATION_HINTS_UNRESOLVED, DECLARATION_UNPRODUCIBLE, DECLARATION_IGNORE_REQUIRED, plus the engine-origin refusal surfaced as a DeclarationError.

Acceptance criteria

• Annotated[int, TextEq] is refused with TYPE_MISMATCH; the message names the field, the marker and the expected type.
• A Passthrough field annotated uuid.UUID is refused with TYPE_MISMATCH (UUID is out of scope for v1).
• A forward reference to an undefined name is refused with HINTS_UNRESOLVED at decoration, on 3.9 and 3.14.
• An unproducible marker reached through the generated module is refused with UNPRODUCIBLE and the catalog reason in the message.
• An Ignore field with no default on a dataclass, attrs class and Pydantic model is refused with IGNORE_REQUIRED.
• The engine's plan_with is invoked at decoration (no credentials needed); a plan the engine refuses raises DeclarationError.
• All checks pass on 3.9 and 3.14.