Deterministic structural change controller for AI-assisted Python development. Bound, verify, and audit agent edits before the diff — one canonical report, every surface (CLI, MCP, SARIF, CI)