python: value rules for every producible type #1392

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 11 of 14.

What to build

Every producible EQL v4 type round-trips from Python and every value rule holds from the public API. The spec's table: int16/32/64 width checks, float32 and float64, Decimal within the engine's bounds, date, timezone-aware datetime only, bool checked before int, None refused on a sealed field, wrong type refused, never coerced.

Codes: VALUE_OUT_OF_RANGE, VALUE_NOT_REPRESENTABLE, VALUE_NAIVE_DATETIME, VALUE_NONE, VALUE_WRONG_TYPE, all raised before any request.

Tests: vitaminc's value vectors run against the Python-to-ValueFrame conversion in the core crate; a cargo-fuzz target in the core crate over the conversion (detached workspace, nightly, registered in fuzz.yml with the replay-only PR job); the live round trip for every producible type on both encrypt and decrypt.

Amendment: error codes are now lower_snake_case. See the amendment on #1341. Read each code in this issue in lower case, such as declaration_no_marker for DECLARATION_NO_MARKER.

Acceptance criteria

• A model with one field per producible type encrypts, inserts, selects and decrypts back equal on the live job.
• Each InvalidValueError code has a test triggering it from encrypt and from query, and the request counter does not move.
• 2**63 on an Int64 field raises OUT_OF_RANGE; float("nan") on a float field is handled per the spec's rule and tested either way.
• A naive datetime raises NAIVE_DATETIME; an aware one round-trips to the same instant.
• True on an Int64 field raises WRONG_TYPE.
• The fuzz target replays its seed corpus in fuzz.yml's PR job and is listed in docs/fuzzing.md.
• vitaminc's vectors pass in cargo test for the core crate.