feat(sdk-review): batch 2/6 — test harness + fixtures

[tiagoek]

Description

Adds 57 bats tests (test_smoke.bats, test_extended.bats) and 6 fixture diffs. Tests exercise the libs from batch 1 end-to-end. Check-specific fixtures land alongside their checks in batches 3-5.

This is part 2 of 6 in the incremental delivery of the SDK Module Review skill (AFSDK-3937).

Each sub-PR is scoped to be reviewable in ≤ 30 minutes and satisfies these isolation criteria:

• Compiles alone (shellcheck / ruff pass)
• Testable alone (bats/pytest pass on top of the prior batches)
• Revert-safe (prior batches keep working if this one is reverted)
• No breaking changes for subsequent batches

Related Issue

Internal tracking: AFSDK-3937

Type of Change

• New feature (non-breaking change that adds functionality)

How to Test

git checkout feat/sdk-review-batch-2
bats tests/sdk-review/          # if applicable to this batch
shellcheck -x --severity=error .claude/scripts/**/*.sh

Batch progression

• PR chore(deps): update traceloop-sdk requirement from ~=0.52.0 to >=0.52,<0.54 #1 — Foundations (libs + config)
• PR chore(deps): update hatchling requirement from ~=1.27.0 to >=1.27,<1.30 #2 — Test harness + fixtures
• PR chore(deps): update opentelemetry-exporter-otlp-proto-grpc requirement from ~=1.38.0 to >=1.38,<1.41 #3 — Safety-first checks (secrets, license, disclosure, hardcode, telemetry)
• PR chore(deps): update setuptools requirement from ~=80.9.0 to >=80.9,<82.1 #4 — Structural checks (docs, bdd, patterns, versioning, commits)
• PR chore(deps): update requests requirement from ~=2.31.0 to >=2.31,<2.33 #5 — Depth checks (testing, errors, http, concurrency, deletion, deps, constants, binding, quality-gate, pr-size)
• PR feat: context propagation and operation type attributes #6 — Wire-up (orchestrate, aggregate, workflow, docs, CONTRIBUTING amendment)

After all 6 batches are merged into feat/sdk-review-skill, a final cosmetic PR will merge feat/sdk-review-skill into main.

Checklist

• Follows Conventional Commits
• Isolated (see criteria above)
• No sensitive information (fixture strings are placeholder patterns, not real credentials)