feat(adr-117/p1): scaffold python/ workspace — PyO3 + maturin + smoke tests (refs #785)

ADR-117 P1 — the python/ directory is now a working maturin-buildable
crate that produces the v2.x replacement for the legacy pure-Python
wifi-densepose==1.1.0 PyPI wheel.

## What lands

- `python/Cargo.toml` — PyO3 0.22 with `extension-module` + `abi3-py310`
  (one binary covers Python 3.10–3.13 per OS/arch — keeps the
  cibuildwheel matrix to 5 wheels per release, not 20). Depends on
  `wifi-densepose-core` from the existing v2/ workspace via relative
  path.

- `python/pyproject.toml` — maturin>=1.7 build backend with
  `python-source = "python"` and `module-name = "wifi_densepose._native"`
  so the compiled module loads as an internal underscore-private
  submodule of the user-facing `wifi_densepose` package. PEP 621
  metadata + classifiers + project URLs. Optional-deps:
  `wifi-densepose[client]` for the P4 WS/MQTT pure-Python layer,
  `wifi-densepose[dev]` for the test toolchain (pytest, ruff, mypy).

- `python/src/lib.rs` — minimal `#[pymodule] wifi_densepose_native`
  exporting `__rust_version__`, `__rust_build_tag__`,
  `__build_features__`, and a `hello()` smoke function. P2 will land
  the core type bindings here.

- `python/wifi_densepose/__init__.py` — pure-Python facade re-exporting
  the compiled module's symbols under their stable user-facing names.
  Docstring teaches the v1→v2 migration story up-front.

- `python/wifi_densepose/py.typed` — PEP 561 marker so `mypy --strict`
  in user code treats the wheel as fully typed (real stubs land in P2).

- `python/tests/test_smoke.py` — 6 P1 acceptance tests:
  1. package imports without error
  2. version string is PEP 440-compliant
  3. `__rust_version__` is reachable from Python (the diagnostic
     surface ADR-117 §5.2 promised)
  4. `__build_features__` lists `p1-scaffold` marker
  5. `wifi_densepose.hello()` returns "ok" (FFI round-trip)
  6. `wifi_densepose._native` is reachable but the leading underscore
     conveys "private; users should import the parent package"

- `python/README.md` — phase ledger, local build instructions
  (`maturin develop`), layout diagram.

## What's deferred to P2+

- Core type bindings (`CsiFrame`, `Keypoint`, `PoseEstimate`) — P2
- Vitals + signal DSP bindings + witness v2 — P3
- Pure-Python WS/MQTT client layer (`wifi_densepose[client]`) — P4
- cibuildwheel + PyPI publish — P5
- v1.99.0 tombstone — concurrent with P5

The new `python/` crate is intentionally OUTSIDE the v2/ Cargo
workspace — it has its own Cargo.toml with `[package]` not
`[workspace.package]` inheritance — to keep maturin's `python-source`
+ `module-name` config self-contained and to avoid forcing every
`cargo test --workspace` invocation in v2/ to compile pyo3.

Refs ADR-117 §5 (Detailed design) and §6 (Phased migration).
Refs #785 (tracking issue).

Co-Authored-By: claude-flow <ruv@ruv.net>

python/src/lib.rs

@@ -0,0 +1,58 @@
+//! ADR-117 — PyO3 bindings for the WiFi-DensePose Rust core.
+//!
+//! This crate is the compiled half of the `wifi-densepose` v2.x PyPI
+//! wheel. The Python-facing facade lives in `python/wifi_densepose/`
+//! and re-exports symbols from this module under their stable names.
+//!
+//! ## Phase status (per ADR-117 §6)
+//!
+//! - **P1 (scaffold) — this commit**: module loads, version constant
+//!   exposed, smoke test passes via maturin develop.
+//! - **P2**: bind `CsiFrame`, `Keypoint`, `PoseEstimate` (next).
+//! - **P3**: bind 4-stage vitals + signal DSP.
+//! - **P4**: pure-Python `wifi_densepose.client` (WS/MQTT) — no Rust
+//!   surface needed; lives outside this crate.
+//! - **P5**: cibuildwheel + PyPI publish.
+
+use pyo3::prelude::*;
+
+/// Version of the bound Rust core. Surfaced to Python as
+/// `wifi_densepose.__rust_version__` so users can correlate wheel
+/// behaviour with the exact `v2/crates/` HEAD it was built from.
+const RUST_CORE_VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Compile-time identifier for the Rust commit that produced this
+/// wheel. Surfaced for diagnostics. Set via `CARGO_PKG_VERSION` for
+/// now; P5 wires in the git SHA via `vergen`.
+const RUST_BUILD_TAG: &str = env!("CARGO_PKG_VERSION");
+
+/// One-line description of which feature flags were enabled at build
+/// time. Helps users debug "is my wheel the slim one or the full one?".
+fn build_features() -> Vec<&'static str> {
+    let mut feats: Vec<&'static str> = Vec::new();
+    // P2 will turn this into a real cfg-driven list as features land.
+    feats.push("p1-scaffold");
+    feats
+}
+
+/// Quick smoke test exposed to Python. Returns "ok" — used by the
+/// integration tests in `python/tests/test_smoke.py` to assert the
+/// PyO3 module is importable and callable.
+#[pyfunction]
+fn hello() -> PyResult<&'static str> {
+    Ok("ok")
+}
+
+/// The `_native` module — re-exported in pure-Python as
+/// `wifi_densepose._native`. End users should import the parent
+/// package (`import wifi_densepose`) and never reach into `_native`
+/// directly; the leading underscore is a Python convention marking
+/// it as private.
+#[pymodule]
+fn wifi_densepose_native(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add("__rust_version__", RUST_CORE_VERSION)?;
+    m.add("__rust_build_tag__", RUST_BUILD_TAG)?;
+    m.add("__build_features__", build_features())?;
+    m.add_function(wrap_pyfunction!(hello, m)?)?;
+    Ok(())
+}