Multi-language SCIP oracle + Python (small-corpus runner)

[skakri]

Tracking epic for the SCIP-oracle reorg, Python support, and a unified small-corpus oracle runner with a before/after resolution table. Plan: docs/plans/2026-06-15-scip-oracle-multilang-runner.md (local, gitignored).

Goal

1. Reorganize GitHub Actions (consolidate the two near-duplicate oracle-* workflows; consistent naming + least-privilege permissions).
2. Add Python indexing + scip-python oracle backend.
3. One corpus-profile-driven runner over small, real repos (semver / cJSON / requests) emitting a typed before/after resolution report (JSON), with a per-PR Δ-vs-main comment via a glue script. Heavy repos (cargo/kernel) keep producing the Bencher series on release.

Sequenced sub-tasks

• A1 chore(ci): workflow naming + least-privilege permissions: sweep; bump deprecated actions (independent)
• C0 feat(oracle): report/profile schema contract + fixture-DB tests — the stabilizer; locks OracleResolutionReport JSON (schema version + provenance envelope + corpus_profile_hash), denominator semantics, and fixture tests for every verdict transition (unresolved→upgraded, unresolved→resolved_external, exact→confirmed, exact→contradicted, oracle-only calls, skipped_drifted, monikers)
• B1–B5 feat(lang): Python indexing (Language enum, tree-sitter grammar, symbols, edges, policy/fixture/tests incl. the import/alias/decorator bad-signal assertions)
• B6 feat(oracle): scip-python backend (OracleTool::ScipPython, manifest, argv test)
• C2 feat(oracle): typed before/after resolution report implementing the C0 contract (TOON + JSON only, no markdown); BMF derived from it
• C1+C3 feat(ci): corpus-profile-driven oracle.yml + tools/oracle-run.sh with the per-corpus health gate; delete oracle-rust.yml/oracle-kernel.yml/tools/{rust-scip,kernel-c}-oracle.sh
• C5 feat(ci): tools/oracle-report-md.py glue (JSON→markdown, Δ-vs-baseline, clean baseline-missing degradation) → job summary + fork-safe PR sticky comment
• C-python test(oracle): small Python corpus profile (package-dir scope, full venv) + validate scip-python resolution

Decisions locked: small corpora run per-PR; heavy corpora → Bencher on release; full venv for the Python corpus; package-dir scope; rag-rat emits JSON/TOON only (markdown via glue); per-report schema version + profile hash; clean baseline-missing degradation; per-corpus health thresholds.

Suggested path: A1 → C0 → (B ∥ C2) → B6 → C1+C3 → C5 → C-python.

[skakri]

Progress:

• A1 → PR chore(ci): workflow hygiene — naming, least-privilege permissions, action bumps (A1) #165 (workflow naming + least-privilege permissions + checkout/cache v4→v5).
• C0 → PR feat(oracle): resolution-report + corpus-profile schema contract (C0) #166 (resolution-report + corpus-profile schema contract, golden hash, per-transition tests).

Next: C2 (live computation + rag-rat oracle report CLI/BMF against the C0 contract) and the Python language work (B), which can proceed in parallel.

[skakri]

Progress (cont.):

• A1 → merged (chore(ci): workflow hygiene — naming, least-privilege permissions, action bumps (A1) #165).
• C0 → PR feat(oracle): resolution-report + corpus-profile schema contract (C0) #166 (schema contract, CI green).
• B1–B5 → PR feat(lang): Python language support (symbols, graph edges, embeddings) #167 (Python indexing: symbols, edges, policy, fixture; 446 core tests green, hybrid eval still passes with Python bound).

Next: B6 (scip-python oracle backend, needs #167) and C2 (live report computation + CLI, needs #166).