chore: prepare 1.3 cleanup on restored main

[ebursztein]

Summary

• preserves the repaired main history while applying the trusted 1.3 cleanup tree
• removes the retired PolicyCallback/callback event-type rail so SecurityEvent uses RuntimeSecurityEventType directly
• deletes stale positive Policy V2 E2E tests and keeps stale event strings only in rejection tests
• updates security action benchmarks to exercise SecurityRuleSet/plugin paths

Verification

• cargo check -p capsem-core --no-default-features
• cargo check -p capsem-service --no-default-features
• cargo test -p capsem-core --no-default-features security_event --lib
• cargo test -p capsem-logger --no-default-features security_rule --lib
• cargo test -p capsem-service --no-default-features --lib
• cargo test -p capsem-core --no-default-features --lib
• cargo test -p capsem-logger --no-default-features --lib
• cargo check -p capsem-core --no-default-features --bench security_actions

Notes

The first commit is a merge-style snapshot: parent one is repaired origin/main, parent two is release/1.3-cleanup-pr, and the tree starts from the trusted cleanup branch. The follow-up burn pass removes the stale callback event identity layer instead of preserving compatibility.

[codecov-commenter]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
1070	1	1069	11

View the top 1 failed test(s) by shortest run time

tests.test_mock_server_launcher::test_mock_server_replays_ollama_openai_chat_completion_shape

Stack Traces | 0.152s run time

def test_mock_server_replays_ollama_openai_chat_completion_shape() -> None:
        proc = None
        try:
            proc, ready = start_mock_server()
            base_url = ready["base_url"]
            request_log = Path(ready["request_log"])
            assert request_log.name == "requests.jsonl"
    
            tool_payload = _post_json(
                f"{base_url}........./v1/chat/completions",
                {
                    "model": "gemma4:latest",
                    "messages": [{"role": "user", "content": "call fixture_lookup"}],
                    "tools": [
                        {
                            "type": "function",
                            "function": {
                                "name": "fixture_lookup",
                                "parameters": {
                                    "type": "object",
                                    "properties": {"query": {"type": "string"}},
                                },
                            },
                        }
                    ],
                },
            )
            assert set(tool_payload) == {
                "id",
                "object",
                "created",
                "model",
                "system_fingerprint",
                "choices",
                "usage",
            }
            assert re.fullmatch(r"chatcmpl-\d+", tool_payload["id"])
            assert tool_payload["object"] == "chat.completion"
            assert tool_payload["created"] == 1781444656
            assert tool_payload["model"] == "gemma4:latest"
            assert tool_payload["system_fingerprint"] == "fp_ollama"
            assert tool_payload["usage"] == {
                "prompt_tokens": 66,
                "completion_tokens": 390,
                "total_tokens": 456,
            }
            choice = tool_payload["choices"][0]
            assert choice["index"] == 0
            assert choice["finish_reason"] == "tool_calls"
            message = choice["message"]
            assert message["role"] == "assistant"
            assert message["content"] == ""
            assert isinstance(message["reasoning"], str)
            assert "Ollama-compatible" in message["reasoning"]
            assert len(message["tool_calls"]) == 1
            tool_call = message["tool_calls"][0]
            assert tool_call == {
                "id": "call_fm3e3d2f",
                "index": 0,
                "type": "function",
                "function": {
                    "name": "fixture_lookup",
                    "arguments": '{"query":"Capsem ironbank poem"}',
                },
            }
    
            text_payload = _post_json(
                f"{base_url}........./v1/chat/completions",
                {
                    "model": "gemma4:latest",
                    "messages": [{"role": "user", "content": "write poem"}],
                },
            )
            assert "provider" not in text_payload
            assert text_payload["id"] == "chatcmpl-515"
            assert text_payload["created"] == 1781444596
            assert text_payload["system_fingerprint"] == "fp_ollama"
            assert text_payload["choices"][0]["finish_reason"] == "stop"
            assert text_payload["choices"][0]["message"]["content"] == (
                "Capsem ironbank poem\nledgers count the sparks\nno secret crosses raw"
            )
            assert "tool_calls" not in text_payload["choices"][0]["message"]
            assert text_payload["usage"] == {
                "prompt_tokens": 26,
                "completion_tokens": 52,
                "total_tokens": 78,
            }
    
            records = [json.loads(line) for line in request_log.read_text().splitlines()]
>           assert len(records) == 2
E           AssertionError: assert 1 == 2
E            +  where 1 = len([{'content_type': 'application/json', 'headers': {'accept-encoding': 'identity', 'connection': 'close', 'content-length': '244', 'content-type': 'application/json', ...}, 'method': 'POST', 'path': '........./v1/chat/completions', ...}])

tests/test_mock_server_launcher.py:339: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}