python: parity with Rust, fixtures, frozen rows, heap hygiene

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 12 of 14.

Proof that the Python SDK and the Rust engine produce and read the same bytes, and that this build's rows stay readable.

A parity binary in the core crate (Rust) and a pytest (Python) seal the same values under the same credentials; the equality terms are byte-identical and each side opens the other's rows.
The four cross-language fixtures the Go SDK uses derive the same bytes from Python.
Frozen rows: stored rows produced by this build are committed as fixtures and a test opens them, so a later build that cannot is red.
Heap hygiene: a test over the extension's copies asserts that plaintext passed to encrypt is not findable in the process heap after the call returns (same approach as the Go SDK's hygiene test).

Parity test passes on the live job: identical terms, cross-open in both directions.
The four fixtures pass from Python with the same expected bytes as Go.
Frozen-row fixtures are committed with the engine commit they were made under; the test is live (needs the keyset) and gated like the other live tests.
Heap-hygiene test passes on Linux in CI; documented as advisory on other platforms if it cannot run there.

Use this existing issue as the Python runner task for milestone 4; do not create a separate parity corpus.

Consume the versioned shared Stack Encrypt corpus and existing fixture paths, with stable case IDs and explicit profiles/capabilities.
Exercise actual Python values and public APIs, including integer ranges, bool/int distinctions, bytes/text, decimal and timezone mappings; coordinate python: value rules for every producible type #1392.
Record the actual Python backend and join fresh artifact exchange in stack-encrypt conformance: expand fresh cross-language artifact exchange #1478.
Make every claimed required case run in CI; distinguish hermetic cases from live-provider cases.
Scope cleanup assertions to extension-owned copies and intermediates. Do not promise erasure of caller-owned Python objects or all plaintext in the process heap; coordinate lifecycle evidence with stack-encrypt conformance: define lifecycle, cleanup and key-I/O requirements #1480 and concurrency with python: concurrency and the sync contract #1394.

#1490 determines whether Python delivery is a stable Rust release gate. This addition preserves the Python implementation work under #1341.