feat: add the SQLClean engine, command and Python custom Rules

.github/RELEASING.md

@@ -0,0 +1,40 @@
+# Releasing
+
+The website and the packages ship separately.
+
+## Website
+
+Cloudflare Pages builds `website/` (`npm ci && npm run build`, output `dist`) from its own Git
+integration. A push to `main` deploys https://sqlclean.io; every other branch deploys a preview
+at `<branch>.sqlclean.pages.dev`. No workflow here deploys the site, and publishing packages never
+touches it.
+
+## Packages
+
+Release Please keeps a release pull request open on `main`. Merging it tags `v0.MINOR.PATCH` and
+dispatches `publish.yml`, which builds the `sqlclean-cli` wheels and both sdists and publishes
+`sqlclean` and `sqlclean-cli` to PyPI.
+
+Release Please counts every Conventional Commit on `main` since the last release, whatever its
+type: `docs:` and `chore:` commits bump the patch version even though their changelog sections
+are hidden or not. What keeps a change out of a release is `exclude-paths` in
+`release-please-config.json`. A commit whose files all sit under `website/`, `benchmarks/` or
+`.github/` is ignored, so site, benchmark and workflow edits never cut a release.
+
+Documentation edits usually do release, on purpose: `make skills` copies the docs into
+`crates/sqlclean-cli/skill/`, which the `sqlclean` executable embeds for `sqlclean skills`, so the
+installed skill stays in step with the docs. A homepage or styling change touches only `website/`
+and does not.
+
+## Verify
+
+`verify.yml` classifies a pull request by the paths it changes and runs only the suites it needs.
+The `Verify` job is the one check to require: it passes when every selected suite passed.
+
+| Change | Suites |
+|--------|--------|
+| Only `website/`, `benchmarks/`, root `*.md`, `.github/demos/`, images, `website.yml` | docs skill check and ruff |
+| Also the bundled skill under `crates/sqlclean-cli/skill/` | plus a Linux build and the `sqlclean skills` tests |
+| Anything else, including workflows, Rust, Python, tests and lockfiles | everything: `make verify`, minimum Rust, Windows, three-platform package smoke tests and the source build |
+
+A manual or release dispatch has no pull request diff, so it runs everything.

.github/scripts/assert_cli_wheel_tags.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Guard the sqlclean-cli wheel tag. The package ships one standalone Rust
+# executable that links no libpython, so an interpreter-specific tag makes the
+# wheel uninstallable on every other Python and silently forces a source build.
+set -euo pipefail
+shopt -s nullglob
+
+directory="${1:?usage: assert_cli_wheel_tags.sh <directory>}"
+wheels=("${directory}"/sqlclean_cli-*.whl)
+
+if [ ${#wheels[@]} -eq 0 ]; then
+  echo "No sqlclean-cli wheel found in ${directory}."
+  exit 1
+fi
+
+status=0
+for wheel in "${wheels[@]}"; do
+  name="$(basename "${wheel}")"
+  case "${name}" in
+    sqlclean_cli-*-py3-none-*.whl)
+      echo "ok: ${name}"
+      ;;
+    *)
+      echo "error: sqlclean-cli wheel must be tagged py3-none-<platform>: ${name}"
+      status=1
+      ;;
+  esac
+done
+
+exit "${status}"

.github/scripts/classify_changes.py

@@ -0,0 +1,55 @@
+"""Decide which Verify suites a change needs from the paths it touches, one per line on stdin.
+
+Prints `full=` and `skills=` lines for GITHUB_OUTPUT:
+
+- Documentation, website, benchmark and image changes need only the light checks.
+- Changes confined to the bundled agent skill also rebuild the executable on Linux and run the
+  skills command tests, because the executable embeds the skill.
+- Any other change, including workflows, Rust, Python, tests and lockfiles, runs every suite.
+
+An empty path list means the diff could not be computed, so every suite runs.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import sys
+
+LIGHT: tuple[str, ...] = (
+    "website/*",
+    "benchmarks/*",
+    ".github/demos/*",
+    ".github/*.png",
+    ".github/*.md",
+    ".github/workflows/website.yml",
+    "*.md",
+)
+SKILL: tuple[str, ...] = ("crates/sqlclean-cli/skill/*",)
+
+
+def classify(paths: list[str]) -> dict[str, bool]:
+    """Return which suites the changed paths need."""
+
+    def matches(path: str, patterns: tuple[str, ...]) -> bool:
+        # `*.md` must only match a root file, while `website/*` matches every depth.
+        return any(
+            fnmatch.fnmatch(path, pattern) and ("/" in pattern or "/" not in path)
+            for pattern in patterns
+        )
+
+    skills: bool = any(matches(path, SKILL) for path in paths)
+    full: bool = not paths or any(
+        not matches(path, LIGHT) and not matches(path, SKILL) for path in paths
+    )
+    return {"full": full, "skills": skills and not full}
+
+
+def main() -> int:
+    paths: list[str] = [line.strip() for line in sys.stdin if line.strip()]
+    for name, value in classify(paths).items():
+        print(f"{name}={str(value).lower()}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())