Rya core (Track A): retry/repair, credentials, streaming chat, Langfuse datasets

[lokesh-danu]

Re-scoped from #1 to contain ONLY the Track A core-runtime primitives:

• A1 declarative tool-call retry + repair
• A2 id-secrecy output guard (scrub master ids)
• A3 per-user connection credential + reconnect-on-401 (store upsert, plaintext-credential deploy gate, needs_reconnect terminal outcome)
• A5 in-turn deterministic student-key adoption

Commits (4), ordered guard → store → runtime → sdk; all changes are under src/ + root tests/.

The csa-counsellor example (Track B) is being moved to another repo, so it is intentionally not part of this PR. Supersedes #1.

[lokesh-danu]

support conversation history in ctx.llm.run

[lokesh-danu]

handler-side credentials, streaming Anthropic chat, Langfuse dataset evals

• ctx.connections.secret(provider, scopes=...) — handler-side analogue of tool
  credential injection: same per-user resolution + scope-intersection enforcement
  as declared url: tools, and the resolved secret is vaulted so it can never
  surface in a trace or log. Deliberately not journaled — a replay re-resolves it
  live rather than memoizing a plaintext credential.
• chat(..., on_token=...) — optional streaming callback on the LLM provider
  layer; the anthropic provider now streams assistant text deltas over SSE while
  assembling the identical {text, toolCalls, model, provider, usage} shape.
  Providers without a streaming path ignore on_token and return the full result
  at once, so passing it is always safe.
• rya eval --langfuse-dataset <name> — pulls an existing Langfuse dataset's
  items, fires a real engine run per item, and links each run's trace back to its
  dataset item as a dataset-run-item (shows up under Datasets → runs in the
  Langfuse UI). An item may carry a Rya expect block under its metadata to be
  scored with the same scorers as local eval cases; a failing item still exits
  non-zero, so a Langfuse dataset can gate a deploy too.

[lokesh-danu]

ruff as linter + formatter — config only, cleanup and CI still pending

The repo had no linting at all, so style and import hygiene were whatever each
file happened to land on. 8def09f adds ruff
(one tool for both lint and format), configured entirely in pyproject.toml:

• line-length = 120 — the tree only has 31 lines over it
• target-version = "py310" to match requires-python
• rule set F, E, W, I, UP, B, C4, SIM, RUF
• three ignores, each with a stated reason: E501 (the formatter owns
  wrapping), B008 (Typer/FastAPI declare params as calls in defaults — 48
  intentional hits), SIM105
• per-file E402 for tests/ (conftest sets sys.path before importing rya)
  and examples/
• ruff>=0.16 in the dev extra; docs/devex.md documents the commands

No source file is touched by this commit — nothing in the diff is
behavioural, so it doesn't affect review of the Track A commits.

Deliberately deferred

The tree is not clean against this config yet. Current baseline:

check	result
ruff check	739 findings, 562 safe-autofixable
ruff format --check	88 of 136 files would be rewritten

Largest buckets: UP045 Optional[X] → X \| None (364), UP006 (95),
E702 semicolon one-liners (78), I001 unsorted imports (53), B904
raise-without-from (48).

Fixing these is intentionally not in this PR. A repo-wide autofix +
reformat would be a ~7k-line diff that buries the actual runtime changes here.
The plan is to converge file by file as they're touched.

CI is also pending. There is no .github/ in this repo, and wiring a
workflow now would only fail red. Once the tree is closer to clean — or as a
changed-files-only gate — lint/format/pytest should run there. Happy to do that
as a follow-up PR.