Sending-side chain direction: validators should gate final wire bytes, but SDKs disagree

Found while matrix-testing SDKs against conformance fixtures (context: #20). Filing separately because this divergence changes security behavior, not just wire shape.

The divergence. For a request on the sending side, the SEP's client trust-boundary order runs mutators before validators, so validation covers the final bytes that will actually cross the boundary. feature/python-sdk derives validate-then-mutate for the same case (matching the Go SDK's receiving-side posture).

Why the order matters, the soundness argument. If validation runs before mutation, mutator output is never validated: a buggy or compromised mutator can reintroduce content after the validator approved the message. Validate-last is the only order where the validator's verdict applies to what is actually sent.

It also has a false-positive cost in the other direction. Concrete case from the behavior fixtures: a redaction mutator that strips credentials, composed with a cross-boundary exfiltration guard. In the SEP order, the redactor defuses the payload first and the guard correctly allows the now-safe write. In the derived validate-first order, the guard sees the verbatim credential before the redactor runs and denies a write that should have been allowed. Same interceptors, same message, opposite outcomes purely from chain direction.

Both behaviors are pinned as executable fixtures in the suite posted on #20 (chain-request-order-mutate-then-validate, redaction-defuses-relaybleed). Related in spirit to the C# divergences already tracked in #15 / #17: this class of cross-SDK drift is exactly what conformance should catch.

Proposal: pin the sending-side order (mutate, then validate) explicitly in the SEP text, and align the direction derivation in feature/python-sdk. Happy to PR the SDK fix with tests if the group agrees.

Read the SEP context from #20 and the feature/python-sdk direction derivation, then inspect the chain-request-order-mutate-then-validate and redaction-defuses-relaybleed conformance fixtures. Confirm the sending-side order in the SEP text, align the Python SDK derivation, and verify the executable fixtures pass with the intended outcomes.