Build the real per-language public-API differ

[ronimoe]

Context

apidiff.py is a sound syntactic lower bound (symbol add/remove + Python signatures). Replace with compiler/type-checker-backed differs per language (cargo-public-api, go/types, TS .d.ts, Python stubtest, JVM ABI). UNCERTAIN => over-bump + human stays the fallback.

Acceptance

Detects signature/behavioural breaks beyond add/remove for >=1 language; unsupported/evasion still routes to UNCERTAIN.

Seam

tools/conductor/apidiff.py.

[ronimoe]

Implemented (this commit).

differs.py is a pluggable ApiDiffer registry (pure — only ast/re); apidiff.py keeps infer_file/infer_bump but delegates to it; shelldiff.py is the external-toolchain differ (injectable, fail-safe).

The adversarial pass caught the killer: the old fold silently skipped any unsupported extension to NONE, so a breaking change in an unscanned language (.rb, .kt, .proto, …) would land as no-bump (fail-open). Fixed: only an explicit non-API allowlist is skipped; every other code file with no claiming differ folds to MAJOR + UNCERTAIN (over-bump + human), never NONE.

The Python AST differ now sees full signatures (param kinds/defaults/annotations, return, posonly/kwonly separators, varargs), exported class members (added → MINOR, removed/changed → MAJOR), and forces UNCERTAIN on dynamic/conditional exports (import *, __all__, __getattr__, def-inside-if/try). Parse failures and differ crashes degrade to MAJOR+UNCERTAIN at the registry boundary — never crashing the verifier. Authority asymmetry is hard-enforced (only an explicitly authoritative=True differ can clear another’s UNCERTAIN). The ShellDiffer fails safe on missing toolchain/timeout/unparseable and caps certain-NONE to UNCERTAIN until the runtime is hermetic.

18 unit tests; full suite now 120. Remaining for full close: register an actual compiler-backed authoritative differ per language (cargo-public-api / go apidiff / TS api-extractor / stubtest) and make the ShellDiffer runtime hermetic — until then the default registry’s soundness is the static-scan lower bound, honestly scoped.