[kvlonge]

Why

The bindings still read SQLBuild's own native views, record properties and dicts through Python, and nothing stopped new Python round trips from being added.

Changes

• fensu guards for the bindings, each with per-file budgets that may only fall:
  • XSB072: Python crossings.
  • XSB073: Python-typed struct fields.
  • XSB074: tests patching sqlbuild._native.
• Strict mode for test runs: a native field read that falls back to Python on SQLBuild's own classes fails unless it is on a committed allowlist. User runs are unaffected.
• field() reads directly from Rust:
  • native pyclass getters, including macro-generated and get_all/#[pyo3(get)] attributes;
  • record properties;
  • Rust __getattr__ views.
• Error classes are captured at module load.
• Multi-line and intern! field chains are read natively.
• Dict get, items and values go through the C API.
• Lookups in stable stdlib modules are cached.
• SQL test planning, model chains and background planning are direct calls with native stage counters; the tests use the counters instead of spies.

Verification

• make test and make check-ci passed, with all optional dependencies available.
• Planner differential matched a fresh main baseline.
• A strict record run over make test and the DuckDB E2E suites produced the allowlist.
• CI runs E2E and the compiler differential.