[bfrancojr]

Adds --format pxf-pb and --format pb-text to scripts/check_decode.py, so the spec's write gate and text gate can check this port. It advances #35 and #37. Both close with the spec PR that adds Python to those gates, which needs this merged first, because spec CI checks out this repo's main.

What the modes do

Both work the way protowire-go's harness does:

• pxf-pb decodes with unmarshal_full, which applies (pxf.default) and checks (pxf.required). It writes the PB bytes on stdout, or exits 1 on a reject.
• pb-text reads the PB with the stock protobuf runtime and writes pxf.marshal's text on stdout.

Map order. The write gate compares map entries in key order. The protobuf runtime here (upb, protobuf 7.36.2) ignores deterministic=True for maps: int32 keys -1, 0, 10, 9 come out as -1, 10, 9, 0. So the harness writes each map entry itself, sorted by key and recursing into sub-messages, and leaves every other field to the runtime. Before that, 6 map cases failed.

The descriptor set comes from text.binpb next to --proto text.proto, which the spec now ships. No change was needed there.

#35's struct-binding table (values.tsv) has nothing to cover here. This port has no struct API of its own; callers use protobuf message classes.

Evidence

Run from the spec at dd8e221, with a scripts change adding Python to the gates (the spec PR), local build against protowire-cpp v2.1.0 (= cpp main, a4977b2):

Gate	Python alone	Python + cpp
write (cross_write_check.sh)	Ran 87 … 0 excluded. ✓	Ran 174 … 0 excluded. ✓
text (cross_text_check.sh)	Ran 60 … 0 excluded. ✓	Ran 120 … 0 excluded. ✓
security (cross_security_check.sh)	—	Ran 136 … ✓

The four corpus rows #1 tracks (deep-nesting-200, -1000, -100000, invalid-utf8-string) each exit 1 with a clean reject. #1 closes when the spec PR makes Python a required port in the security workflow.

The repo's own tests don't exercise check_decode.py. The gates above are its test.

[bfrancojr]

CI on 5274043: all 18 checks pass (12 test legs, 3 cibuildwheel smoke builds, CodeQL). The repo's tests don't run check_decode.py; the gates in the PR body are its test. trendvidia/protowire#590's CI built this repo's main in the new workflow step and ran the security gate with python required: Ran 504 (port, corpus) pairs across 7 ports. ✓. Its write and text jobs fail only because main's harness lacks the modes this PR adds: check_decode: error: argument --format: invalid choice: 'pb-text'.