[kvlonge]

Why

SQLBuild is moving to a Rust-hosted architecture where Python remains only for user code, adapters, the executor and public Python APIs. Earlier migration work left Python drivers and fallbacks in place. This makes completion measurable and stops new Python or Python fallbacks from slipping in unnoticed.

Changes

• python-boundary.toml lists the modules that stay Python, each with a reason (user-code, adapter, executor, public-api) and a note. Every other Python file under src/sqlbuild is movable; remaining_lines (146,314 today) must equal their line count, so adding movable Python fails and every reduction lowers the committed number.
• The same check fails when code swallows a native failure: a try or suppress around a native call (including _native_* wrapper modules) whose handler does not raise on every path. Four reviewed exceptions are listed with reasons (cache misses and a reported lint error, not Python fallbacks).
• make check-python-boundary, included in make check-ci.
• AGENTS.md: migration rules (delete replaced Python, no fallbacks, allowlist changes need a reason and user approval, moving code into a staying path is not progress).
• New E2E: a project-local adapter's render_create_table_as override is used by sqb build.

Verification

• uv run pytest tests/unit/scripts/python_boundary tests/e2e/src/sqlbuild/cli/commands/main/adapters
• make check-ci (includes the new check against the repository)