Fix scoped Python SDK setup and prepare 26.10.0 clients

[ancongui]

Workspace and dataset lookup helpers now pass the required tenant/workspace context and create only after an HTTP 404. Authorization, transport, validation and server failures propagate without attempting a write; concurrent creation conflicts remain visible.

Update the Python client guide and examples to use supported imports, workspace UUIDs, explicit generated parameters and scoped agent routes. Make SDK lint, formatting, type checks and HTTP-contract tests mandatory in PR and publication workflows. Keep service/client release metadata aligned at 26.10.0, including runtime headers and the embedded API snapshot; generated methods and DTO schemas are unchanged. Python packages continue to be distributed through GitHub Release assets.

Validation:

• 386 service unit tests; server lint/format; type checking with zero errors and nine existing warnings.
• 18 SDK tests from source and the installed wheel; 144 SDK files pass mypy.
• Independent HTTP probes cover context headers, lookup failures, disconnects, malformed responses and creation conflicts.
• Actual pyfly workspace/dataset controllers and PostgreSQL repositories exercised over TCP with the installed SDK in an isolated test schema. The database role bypasses RLS, so this validates repository scope filtering rather than database RLS enforcement.
• SDK-only installations on Python 3.9 and 3.13; Java 25 mvn verify; 28 README banner checks across viewport and color themes.

No model-provider calls or cloud deployments were used. Full-service boot, direct-SQL SDK service integration and server-side execution isolation remain separate validation boundaries. Existing release assets remain unchanged; publish the 26.10.0 assets after CI and release approval.