feat(sdk-review): batch 5/6 — depth checks + PR-size advisory

[tiagoek]

Description

Adds 10 checks: testing-depth, errors-logging, http-hygiene, concurrency, deletion-hygiene, deps-supply, constants (AST), binding-shape (BND-02 BLOCK_LOCKED), quality-gate-parity, pr-size (SHADOW, advisory).

This is part 5 of 6 in the incremental delivery of the SDK Module Review skill (AFSDK-3937).

Each sub-PR is scoped to be reviewable in ≤ 30 minutes and satisfies these isolation criteria:

• Compiles alone (shellcheck / ruff pass)
• Testable alone (bats/pytest pass on top of the prior batches)
• Revert-safe (prior batches keep working if this one is reverted)
• No breaking changes for subsequent batches

Related Issue

Internal tracking: AFSDK-3937

Type of Change

• New feature (non-breaking change that adds functionality)

How to Test

git checkout feat/sdk-review-batch-5
bats tests/sdk-review/          # if applicable to this batch
shellcheck -x --severity=error .claude/scripts/**/*.sh

Batch progression

• PR chore(deps): update traceloop-sdk requirement from ~=0.52.0 to >=0.52,<0.54 #1 — Foundations (libs + config)
• PR chore(deps): update hatchling requirement from ~=1.27.0 to >=1.27,<1.30 #2 — Test harness + fixtures
• PR chore(deps): update opentelemetry-exporter-otlp-proto-grpc requirement from ~=1.38.0 to >=1.38,<1.41 #3 — Safety-first checks (secrets, license, disclosure, hardcode, telemetry)
• PR chore(deps): update setuptools requirement from ~=80.9.0 to >=80.9,<82.1 #4 — Structural checks (docs, bdd, patterns, versioning, commits)
• PR chore(deps): update requests requirement from ~=2.31.0 to >=2.31,<2.33 #5 — Depth checks (testing, errors, http, concurrency, deletion, deps, constants, binding, quality-gate, pr-size)
• PR feat: context propagation and operation type attributes #6 — Wire-up (orchestrate, aggregate, workflow, docs, CONTRIBUTING amendment)

After all 6 batches are merged into feat/sdk-review-skill, a final cosmetic PR will merge feat/sdk-review-skill into main.

Checklist

• Follows Conventional Commits
• Isolated (see criteria above)
• No sensitive information (fixture strings are placeholder patterns, not real credentials)

[tiagoek]

Superseded by consolidation into 2 PRs:

• Foundation (libs + config + tests): feat(sdk-review): foundation — libs + config + test harness #211
• Skill (checks + orchestrate + FP remediation + docs): feat(sdk-review): skill — 20 checks + orchestrate + GH Action + FP remediation #212

Rationale: the 6-batch split proved counterproductive during review — reviewers needed to page across 6 diffs to understand a single feature. Also, the FP-remediation fix (9 patterns eliminated, 94% FP reduction) touched scripts introduced across batches 3-5, making atomic per-batch cascading impractical without hand-editing conflicts.

The 2-PR consolidated flow keeps stack discipline (foundation → skill) while making each PR self-contained and reviewable in one sitting. All content from this batch is present on #211 or #212.

No functional change was lost. Closing to reduce reviewer confusion.