chore(deps): Bump agent-hooks-sdk from 0.1.0a3 to 0.1.0a4 in /sdk/python in the python group

[dependabot]

Bumps the python group in /sdk/python with 1 update: agent-hooks-sdk.

Updates agent-hooks-sdk from 0.1.0a3 to 0.1.0a4

Changelog

Sourced from agent-hooks-sdk's changelog.

Changelog

User-visible changes to the spec and SDKs. Versioning rules: https://github.com/responsibleai/agent-hooks/blob/main/VERSIONING.md.

Unreleased

• §12.1 admits incremental mediation. Previously a host had to assemble the complete response before post_model_call with no exception, so a host mediating a stream incrementally (e.g. per ACS §18.1) could not make a coherent conformance claim. §12.1 now carries an exception: a host declaring buffered_output: false MAY evaluate incrementally under a bounded-exposure accounting discipline (verdict-covered release, terminating deny that withholds the unreleased remainder, fail-closed residue at end of stream, §6.1-gated durability covering withheld-but-permitted content). The capability stays declaration-only: the §12.1a declaration and §13.3 claim MUST state the exposure bound, and conformance vectors for the accounting discipline are future work. §12.1 also now distinguishes an errored model call (handled per §6.1, no post_model_call) from the stream_incomplete shape, which is for hosts that cannot buffer. Additive; no version-surface change.
• §12.1a defines the caller and pins released-content identity. The caller is any consumer outside the host's enforcement boundary, observers, callbacks, and preview channels included, and the content released once the verdict permits MUST be the verdicted (post-transform) content — a host MUST NOT rewrite content between the verdict and its release.

0.1.0-alpha.4 — tag v0.1.0-alpha.4

• .NET: the NuGet package ships the native library. The nupkg now bundles the FFI cdylib for four runtime identifiers (runtimes/{linux-x64,osx-x64,osx-arm64,win-x64}/native/), so package consumers no longer build agent_hooks_ffi from source. The release pipeline cross-builds all four targets and asserts their presence in the packed package.
• deny constructor sugar in every SDK. A plain, final deny (reason + optional message, no approval block) alongside the existing warn/escalate sugar: Rust Verdict::deny, Python Verdict.deny, TypeScript Verdict.deny, .NET Verdict.Deny, and Go DenyVerdict (suffixed like AllowVerdict because Deny is the Decision constant). (Merged after the alpha.3 tag; previously listed under alpha.3 in error.)
• Go: Interceptor.OnHook renamed to Intercept, aligning the interceptor protocol method with Python/TypeScript intercept and .NET InterceptAsync. Clean rename, no alias (pre-release; drafts within the 0.1 window are not compatibility-bound). (Merged after the alpha.3 tag; previously listed under alpha.3 in error.)
• Registry publishing is trusted-publishing-only on every registry;

... (truncated)

Commits

• f38b868 style: define the pin guard before its entrypoint call
• 8ab65c9 release: inject npm platform pins at publish time
• 4801a48 ci: install the Go toolchain before CodeQL init
• c5fca2c ci: build the Go modules from their directories for the CodeQL extractor
• 3e45109 ci: manual build mode for the Go CodeQL leg
• 137865e ci: CodeQL advanced setup so fork pull requests can satisfy the gate
• 2b23107 spec: schema $id URIs point at the documentation site, which now serves them
• bef0104 ci: add the windows-latest leg to go-xplat via the gnu ffi target
• 5b84b0a conformance: file the agent-control-spec claim
• c9df017 release: bump every SDK surface to 0.1.0-alpha.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Prayag (prayagupa)]

there is a new version agent-hooks-sdk 0.1.0a5 now