python: README, repo docs, scorecard #1395

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 14 of 14.

What to build

A developer new to the SDK can follow the README from zero to a queried row, and the repo's own design documents reflect that the Python SDK exists.

README (in the Python workspace): the ordered steps (credentials, EQL v4 install, DDL with the eq_term index, declare, Cipher, encrypt and insert with no cast, query with the query_sql_domain cast, select all declared columns, decrypt); the redaction scope (repr/str only, not logging or pickling); the no-mutation-after-Cipher contract; UUID workarounds (store as str passthrough); the sync and one-client contract.

Repo docs riding in the same PR: ADR-0001's status moves to accepted; the 2026-10-13 findings notes gain "superseded by #1341" pointers where the spec overrode them; a Python row in ADR-0002; a Python section started in the SDK design principles doc; the G1 to G8 scorecard filled from the shipped behaviour.

Acceptance criteria

• A fresh reader following only the README on a clean machine with credentials reaches a successful equality query (verified by someone other than the author, or by a scripted run of the README's commands).
• Every SQL snippet in the README is executed by a test (doc-anchor style) so it cannot drift.
• ADR-0001 status: accepted; ADR-0002 has the Python row; the principles doc has the Python section; the scorecard is in the workspace docs.
• AGENTS.md Repository Layout lists languages/python and the fourth Cargo workspace; SECURITY.md's package list is updated.
• No Linear IDs in any committed file.