feat: RFC-005 Step 9 — PIP request builder types (#46)

* feat: add RFC-005 PIP request builder types

Add capiscio_sdk/pip.py with PIP request/response dataclasses for SDK
consumers building custom PEP integrations:

- PIPRequest, PIPResponse, Obligation (request/response types)
- SubjectAttributes, ActionAttributes, ResourceAttributes,
  ContextAttributes, EnvironmentAttributes (attribute groups)
- EnforcementMode enum with stricter_than() and from_env()
- Constants: PIP_VERSION, DECISION_ALLOW, DECISION_DENY, DECISION_OBSERVE
- Auto-populates txn_id (UUID v7/v4) and environment.time (ISO 8601)
- Envelope fields serialize as JSON null (not absent) in badge-only mode

RFC-005 Step 9 implementation.

44 unit tests, full serialization roundtrip coverage.

* fix: normalize EnforcementMode enum to string in ContextAttributes

Accept Union[str, EnforcementMode] for enforcement_mode and normalize
to string value in __post_init__. This prevents json.dumps() failures
when callers pass EnforcementMode.from_env() directly.

Addresses PR review feedback.

Author: beonde

capiscio_sdk/__init__.py

@@ -66,6 +66,23 @@
 # Event emission
 from .events import EventEmitter
 
+# RFC-005: PIP request/response types
+from .pip import (
+    PIPRequest,
+    PIPResponse,
+    SubjectAttributes,
+    ActionAttributes,
+    ResourceAttributes,
+    ContextAttributes,
+    EnvironmentAttributes,
+    Obligation as PIPObligation,
+    EnforcementMode,
+    PIP_VERSION,
+    DECISION_ALLOW,
+    DECISION_DENY,
+    DECISION_OBSERVE,
+)
+
 __all__ = [
     "__version__",
     # Security middleware
@@ -119,5 +136,19 @@
     "AgentIdentity",
     # Event emission
     "EventEmitter",
+    # RFC-005: PIP types
+    "PIPRequest",
+    "PIPResponse",
+    "SubjectAttributes",
+    "ActionAttributes",
+    "ResourceAttributes",
+    "ContextAttributes",
+    "EnvironmentAttributes",
+    "PIPObligation",
+    "EnforcementMode",
+    "PIP_VERSION",
+    "DECISION_ALLOW",
+    "DECISION_DENY",
+    "DECISION_OBSERVE",
 ]