feat(agentmesh-cop): watch the mesh as a member through the Python SDK

agentmesh-cop joins the mesh with the Python SDK, holds every listed router
and alerts on:

- control-plane sync failing and recovering
- control-plane signing keys added and retired
- routers listed, delisted, unreachable and reachable again
- peers banned and unbanned
- the mesh unreachable, told apart from the cop's own isolation
- services appearing and disappearing, named as <type>://<name> for mcp,
  inference, a2a and egress

Alerts go to stdout and, when configured, Telegram and Slack. The tests
run under make sdk-python and the SDK workflow.

Author: kaisoz

.github/workflows/sdk.yml

@@ -24,6 +24,7 @@ on:
     branches: [main]
     paths:
       - 'sdk/**'
+      - 'development/tools/agentmesh-cop/**'
       - 'api/agentmesh.proto'
       - 'hack/gen-sdk-proto.sh'
       - 'hack/gen-sdk-docs/**'
@@ -36,6 +37,7 @@ on:
     branches: [main]
     paths:
       - 'sdk/**'
+      - 'development/tools/agentmesh-cop/**'
       - 'api/agentmesh.proto'
       - 'hack/gen-sdk-proto.sh'
       - 'hack/gen-sdk-docs/**'

Makefile

@@ -166,7 +166,8 @@ e2e-test: build docker-build
 # tests and leave it installed, which is what TestNativeSDKs needs to run
 # both against a real control plane instead of skipping. sdk-js also
 # compiles the example programs the docs embed; TestNativeSDKExamples runs
-# them.
+# them. sdk-python also runs agentmesh-cop's tests, since the cop runs on
+# the Python SDK.
 .PHONY: sdk-js sdk-python sdk-proto sdk-docs sdk-test
 sdk-js:
 	cd sdk/js && npm ci --no-fund --no-audit && npm test && npm run build && npm run examples
@@ -175,6 +176,7 @@ sdk-python:
 	python3 -m venv sdk/python/.venv
 	./sdk/python/.venv/bin/pip install -q -e './sdk/python[test,examples]'
 	./sdk/python/.venv/bin/python -m pytest -q sdk/python/tests
+	./sdk/python/.venv/bin/python -m pytest -q development/tools/agentmesh-cop
 
 sdk-proto:
 	./hack/gen-sdk-proto.sh