[xiaoqi-7]

Reason for Change:

Reuse KAITO's shared streaming guardrail window in ext_proc without maintaining a second holdback or safe-prefix release implementation.

• Pin guardrail-core to KAITO commit dda1b10e881ed69228978964a2e89ecf241757f9 through its immutable source archive; no floating main dependency or copied source.
• Add a per-response lifecycle adapter that delegates buffering, scanning, redaction, and safe release to the shared window and returns its result types unchanged.
• Flush only on successful completion. Block, scanner failure, cancellation, and explicit abort are terminal; subsequent input or completion raises instead of releasing retained text.
• Align ext_proc metadata, CI, and the digest-pinned container to Python 3.12. The image build verifies shared API and adapter imports.
• Document the dependency source, character-based holdback, caller responsibilities, and integration limits.

Requirements

• added unit tests and e2e tests (if applicable).

Issue Fixed:

Related to #229. This is the narrowly scoped shared-window adoption step, not completion of the broader streaming integration.

Notes for Reviewers:

Dependency:

• The pinned commit contains the shared-window extraction in refactor: share streaming guardrail window with gateway consumers kaito#2454, which is currently open. This PR installs that exact commit, not an unmerged floating branch.

Validation:

• 97 tests passed on Python 3.12, including existing gRPC skeleton regressions.
• Adapter coverage includes all text partitions of a sensitive marker, cross-feed redaction/blocking, Unicode, holdback boundaries, preceding-character propagation, final scanning, repeated completion, upstream abort/cancellation, scanner failures, request isolation, and equivalence with direct shared-window calls.
• Focused Ruff lint/format checks, whitespace checks, CI YAML validation, and pip check passed.
• Built the adapter wheel, installed it with its pinned dependency into a fresh environment outside the source tree, and verified imports, runtime behavior, and the installed dependency's source SHA.
• Local Docker build remains blocked: default and host-network builds fail TLS handshakes to files.pythonhosted.org while fetching setuptools. The same failure reproduces in the unmodified official Python base container. TLS verification was not disabled. The CI image build/import gate is configured, but a successful image build has not yet been verified.

Scope:

• No Process integration; it still returns UNIMPLEMENTED.
• No SSE/OpenAI parser migration, local scanner/policy implementation, or Envoy E2E protection claim.
• E2E tests are not applicable to this adapter-only change; the checked requirement above refers to the added unit/adapter tests.