Verify published Python update failure diagnostics

[rmcdaniel]

Change

Completes the consumer qualification for durable-workflow/sdk-python#100. Pin published Python SDK 2.4.3 and strengthen the existing live update experiment.

The failed Rust handler must raise Python's public UpdateFailed with the exact durable handler message, HTTP 422, the original response, and matching workflow/run/update/failure IDs. A second request with the same request ID must raise the same failure with one accepted update and one failed completion. The original workflow stays live and later finishes once.

Admission is checked through canonical command_status: accepted and durable UpdateAccepted history. The public API omits accepted: true; an explicit false value remains rejected by the observer.

The nine PHP/Python/Rust client/handler directions, Rust SIGKILL replacement, successful duplicate request and validator refusal checks remain in the same experiment. Only the affected Python pin changes.

Verification

All 56 local observer/worker metadata tests passed in a Python container. They include negative cases for empty diagnostics, wrong HTTP status or identity, and rejected updates. The full live run uses published packages and the installed SDK's actual Avro serializer. Normal CI, published timers, candidate image, polyglot smoke, ordinary Compose smoke and public boundary checks all passed.

Published update run passed at aff471f1cc8c7bd83cd1c4075082ce0eb68b63e4: all nine directions, original run/history checks, SIGKILL replacement, successful duplicate, typed failed duplicate, validator refusal and three original workflow completions. Both failed requests returned UpdateFailed("codec error: update-probe-failure"), HTTP 422, update 01m4cfwcv74nej80k599w7c2t4, run 01m4cfvvkqv1pp0rcjxp9vkz73 and failure 01m4cfwdpa41w72zf3ntyt3hzt, with exactly one durable failed completion.

Reviewed that exact candidate: only the Python tuple pin, live observer, observer tests and experiment README changed. Initial builds received a PyPI index without the just-published version. After publication verification, the live run identified an observer assumption about the omitted accepted: true field. The corrected candidate uses the canonical command status and has passed actual published execution and all normal gates.

Merged at c3377e18b89ce83838570c81eb4d592200c330e8, with identical reviewed tree. Main updates, main timers, ordinary CI/smoke/polyglot and native image publication all passed. Anonymous GHCR/Docker Hub reads verified immutable and main images at sha256:704c829151389be0477de946c8cd1457193f041992776af45625f6241666aee5, with both architectures matching the merge. Both task branches are deleted and verified absent. Worktrees, caches and scratch are cleaned. SDK Python #100 is delivered.