[ancongui]

Table and schema reads now retain the requested tenant/workspace scope through parent joins. A current snapshot is exposed only when its table, dataset, tenant and workspace match. An invalid stored pointer leaves the table available without exposing the other scope's snapshot metadata.

The Python SDK adds a GET-only AgentReadClient with fixed tenant/workspace/dataset scope, parent-snapshot validation and bounded connections, responses and catalogs. It uses agent routes and cannot execute queries. Server and SDK versions align at 26.10.4; both Maven JARs include the existing Apache license. Protocol shapes and third-party dependencies are unchanged.

Validation:

• All seven PR checks pass at cf197115ee3ffef80d16ba275f5c3192626d0cbd: 531 server unit tests; 111 integration tests with 15 skips; Python SDK 89 tests and the configured mypy check over 147 files; Java SDK 722 passes and 135 skips. Server pyright reports zero errors and 12 warnings under its advisory policy.
• One additional local PostgreSQL exercise verifies 28 snapshot-pointer, eight parent-scope and three object assertions through the actual service/repository queries. Every one of 98 connection checkouts was confined to its owned schema. This uses an authorized setup role with BYPASSRLS; the existing CI integration suite separately covers application RLS. Skips remain unverified.
• Independent source/security review found no actionable issue. Six offline package archives passed source, version and license checks. The original failed qualification evidence remains preserved.

The forge adapter and a prepared-query-result agent mirror are outside this change. Publication and remote asset checks follow merge. Application deployment stays local.