ci: DRIFT is advisory here — python is the reference, not a port

[anthmFS]

Makes DRIFT advisory in this repo only, so python can merge and publish without a lockstep change in porting-sdk.

The inversion

For the nine ports, DRIFT is a hard gate and should be: it asks whether the port
still matches the reference, and a port can be wrong about that.

This repo is the reference. python_signatures.json is derived from this
tree. Python cannot drift from itself — a difference after regeneration means
only that the snapshot in porting-sdk has not caught up.

Gating python's CI on that inverted the dependency. Adding public API here — an
ordinary thing to do in a reference implementation — turned python red until
someone landed a change in another repo. The source of truth was blocked on its
own derivative. That is why v3.3.0 has been sitting unpublishable while a
coordinated pass was in flight, and why every recent surface change here needed
a paired porting-sdk PR before it could go green.

What changes

DRIFT prints the delta and returns 0:

[DRIFT] oracle snapshot vs this tree (ADVISORY — python is the reference) ... PASS
    ADVISORY: this tree's public surface differs from porting-sdk's committed
    oracle (1 file changed, 682 insertions(+)). That is expected when you add
    or change public API.

The delta is printed because it is genuinely useful — it is exactly the new
surface, and exactly what gets regenerated downstream after this merges.

What does not change

• The ports keep their hard DRIFT gate against the reference. Untouched.
• SIGNATURES still runs on every build and still fails loudly if this tree
  cannot be enumerated at all.
• SEMVER-DIFF still depends on it, so a version bump that does not match the
  surface change is still caught here.

The only thing removed is python failing because another repo's file is stale.

Verified

Both paths exercised: with a clean snapshot it reports "matches this tree"; with
new public API present (replayed a real +682-line regen) it prints the shortstat
and passes. Full run-ci otherwise unchanged — the only reds are TYPECHECK and
TEST at main's known baseline (the mcp_gateway/search findings that depend on
which optional extras are installed, and the 6 pre-existing mcp_gateway test
failures).

🤖 Generated with Claude Code

https://claude.ai/code/session_015dYktt85Ltj3oK9gG5VBww