feat: add Rust kernel bridge foundation

[MapleEve]

Summary

• Add a Rust workspace with the voscript_core PyO3 extension foundation and a safe core_smoke entrypoint.
• Add the Python kernel bridge and static provider capability metadata for required vs degradable multilingual stages.
• Add RUST_KERNEL_MODE=off|required, keep runtime default off, and wire Docker/release packaging to install the built wheel when supplied.
• Add a Rust foundation heavy gate that runs on PR first round, main pushes, and manual dispatch.
• Update public configuration/changelog docs for the new env, packaging gate, and security floor.

Validation

• PR checks on 63bc927: lint, test, security-scan, fossa, codecov/project, codecov/patch, and WIP all passed.
• Heavy Gate run 27210189819 on 63bc927 passed both jobs: rust-wheel and docker-packaging.
• python -m pytest tests/unit -q — 148 passed.
• ruff check app/ tests/unit/test_kernel_bridge.py tests/unit/test_provider_capabilities.py --ignore E501 passed.
• cargo fmt --manifest-path crates/voscript_core/Cargo.toml -- --check passed.
• cargo test --manifest-path crates/voscript_core/Cargo.toml — 2 passed.
• cargo clippy --manifest-path crates/voscript_core/Cargo.toml --all-targets -- -D warnings passed.
• Public release scan passed.
• Local wheel smoke: built voscript_core with maturin --features extension-module, installed into a temporary CPython 3.12 venv, and verified core_smoke.

Notes

• FOSSA is passing after raising python-multipart to >=0.0.27,<0.0.28, which avoids the flagged 0.0.26 vulnerability without broad dependency drift.
• Docker packaging is intentionally validated by the Heavy Gate, not by local packaging.
• Runtime default stays RUST_KERNEL_MODE=off; selected Rust-backed paths fail closed only when explicitly set to required.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[codecov]

Codecov Report

❌ Patch coverage is 94.54545% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.39%. Comparing base (7b49fb0) to head (63bc927).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
app/providers/capabilities.py	95.16%	3 Missing ⚠️
app/providers/kernel_bridge/runtime.py	93.18%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #35      +/-   ##
==========================================
+ Coverage   91.24%   91.39%   +0.14%     
==========================================
  Files          76       79       +3     
  Lines        3039     3149     +110     
==========================================
+ Hits         2773     2878     +105     
- Misses        266      271       +5     

Flag	Coverage Δ
unit	91.39% <94.54%> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

Introduces the initial Rust “kernel bridge” foundation for VoScript by adding a minimal PyO3-backed voscript_core extension (with a core_smoke entrypoint), plus Python-side bridging/config to gate Rust-backed paths via RUST_KERNEL_MODE. It also adds static provider capability metadata for language/stage matching, and wires CI + Docker/release packaging to build and install an internal wheel.

Changes:

• Added a Rust workspace + voscript_core PyO3 extension with a smoke-test API.
• Added Python kernel bridge runtime helpers and provider capability metadata + unit tests.
• Updated Docker/release workflows and documentation to support RUST_KERNEL_MODE and internal-wheel packaging.

Reviewed changes

Copilot reviewed 21 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/unit/test_provider_capabilities.py	New unit tests for provider capability metadata and language matching behavior.
tests/unit/test_kernel_bridge.py	New unit tests for the Python-side Rust kernel bridge and smoke call behavior.
tests/unit/test_config_defaults.py	Extends config default tests to cover RUST_KERNEL_MODE normalization/defaults.
docker-compose.yml	Exposes RUST_KERNEL_MODE into the container environment with a safe default.
doc/configuration.zh.md	Documents the new RUST_KERNEL_MODE configuration (Chinese).
doc/configuration.en.md	Documents the new RUST_KERNEL_MODE configuration (English).
doc/changelog.zh.md	Adds changelog entries for the Rust foundation and CI heavy gate (Chinese).
doc/changelog.en.md	Adds changelog entries for the Rust foundation and CI heavy gate (English).
crates/voscript_core/src/lib.rs	Implements the PyO3 core_smoke function and module wiring.
crates/voscript_core/Cargo.toml	Defines the Rust crate, features, and PyO3 dependency for the extension.
Cargo.toml	Adds a Rust workspace at the repo root.
Cargo.lock	Locks Rust dependencies for reproducible Rust builds.
app/providers/kernel_bridge/runtime.py	Adds fail-closed Python bridge helpers (require_rust_core, core_smoke, mode parsing).
app/providers/kernel_bridge/__init__.py	Exposes kernel bridge public API from the package.
app/providers/capabilities.py	Adds static capability records and a language matching API for provider stages.
app/providers/__init__.py	Re-exports capability helpers/types from the providers package.
app/Dockerfile	Installs an internally provided voscript_core wheel during image build when present.
app/config.py	Adds RUST_KERNEL_MODE configuration default/normalization.
app/.wheelhouse/.gitkeep	Ensures the wheel staging directory exists in the Docker build context.
.gitignore	Ignores Rust build artifacts and wheelhouse wheel outputs.
.github/workflows/rust-foundation-heavy.yml	Adds a heavy CI gate to build/test the Rust wheel and validate Docker packaging.
.github/workflows/release.yml	Builds/stages the internal Rust wheel and passes it into the Docker build for release images.
.env.example	Documents RUST_KERNEL_MODE in the example environment file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.