Dual-mode SDK: hosted, embedded ML, sidecar

[chiruu12]

Summary

• Adds three deployment paths (hosted API, local embedded ML, local sidecar) with docs, examples, and unplug-sidecar CLI
• Pins ML validation to checkpoint-66630 (DeBERTa-v3-xsmall dual-head) with integration tests, smoke probes, and scenario replay
• Adds LangGraph/Agno integration hooks, agent hardening (boundaries, toolchain, collusion), YARA scanner, and expanded regex patterns
• Docker sidecar E2E is opt-in via RUN_DOCKER_E2E=1 / make docker-e2e so default CI stays fast

Test plan

• make check-ci — 611 passed, 6 skipped
• make smoke-ml — TP=8 FN=0, audit 11/11 (1 known regex FP on joke_ignore)
• Server repo: 48 tests passing
• make docker-e2e (manual, ~10 min build)

Related

• Server PR: unplug-server feat/dual-mode-validation (sidecar compose, tiny tier, v13 thresholds)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.