feat(observability): CI guard to enforce attributed SDK client construction (#319 follow-up)

[scottschreckengaust]

Problem

#319 (PR #345) routes every AWS SDK client through an attributed factory (makeClient/makeDocClient in TS; tenant_client/platform_client in Python) so no outbound AWS call loses solution attribution. But that invariant is currently convention-only — a contributor can still write a naked new S3Client({}) / boto3.client(...) and it compiles, passes tests, and works, silently losing attribution. This is exactly how the pattern decayed before: 5 naked SDK sites appeared on main while #345 was in review.

The factory is the easy path; this issue adds the hard gate that makes a naked client fail the build.

Proposed enforcement (mirrors the repo's existing invariant-regression pattern)

• scripts/check-ua-coverage.mjs modeled on scripts/check-types-sync.ts — scans cdk/src + cli/src (TS) and agent/src (Python) for client construction outside the helper modules; exits non-zero on any naked site. Wire into mise.toml drift-prevention (a build dependency) + a repo:local prek hook.
  • Note: use git-pathspec 'cdk/src/' 'cli/src/' (directory prefix), not 'cdk/src/**/*.ts' — the **/*.ts glob does not match files directly under src/ and hid a bypass during feat(observability): solution attribution via native AWS_SDK_UA_APP_ID (#319, alt to #338) #345 review (cli/src/webhook-test.ts).
• ESLint no-restricted-syntax NewExpression[callee.name=/Client$/] in cdk/eslint.config.mjs + cli/eslint.config.mjs, with an override disabling it in the ua.ts helper files (sharper than the script for the TS side).
• Python side via ruff flake8-tidy-imports banned-api or a .semgrep/ rule (the latter gives the # nosemgrep: <rule-id> -- <reason> allowlist the repo already documents).
• Optionally a ratchet-baseline variant (like scripts/check-deadcode-ratchet.mjs) only if debt must remain temporarily; feat(observability): solution attribution via native AWS_SDK_UA_APP_ID (#319, alt to #338) #345 leaves the census at zero, so a hard gate should be feasible immediately.

Acceptance

• A PR that adds a naked new XxxClient({}) (cdk/cli) or boto3.client(...) (agent, outside aws_session.py) fails mise run build and the prek hook.
• The three md/ sanitizers stay locked identical via a shared cross-language fixture.

Context

• Builds on feat(observability): inject solution into outbound AWS SDK User-Agent #319 / PR feat(observability): solution attribution via native AWS_SDK_UA_APP_ID (#319, alt to #338) #345 (the factory).
• Depends on nothing; feat(observability): solution attribution via native AWS_SDK_UA_APP_ID (#319, alt to #338) #345 should merge first so the census is already zero.