CI: real-stack live smoke on PRs and a nightly upstream drift gate against guard-core master #133

fastapi-guard PRs only run TestClient-level tests on the Python matrix. Nothing exercises the adapter on a real uvicorn, nginx and Redis stack, and nothing runs the suite against guard-core master before a guard-core release lands on PyPI.

Two gaps found during the 4.0.0 / 8.0.0 release:

1. The 8.0.0 websocket handshake scan had no end-to-end coverage; a consumer's container harness saw it inert on their websocket route.
2. guard-core's Ecosystem Gate runs adapter suites on a guard-core PR wheel, but nothing runs from this side, so adapter breakage from an upstream change is only visible after the guard-core release.

Add:

• live-smoke.yml: port guard-core's live-smoke stack, build the fastapi-guard wheel from the PR checkout, run the example app behind nginx with Redis and the agent and OTLP stubs, drive every scenario with the completeness gate, and add websocket handshake scenarios (attack-shaped handshake rejected, blacklisted IP rejected, benign echo accepted).
• upstream-drift.yml: nightly and on demand, run the full suite with a guard-core wheel built from guard-core master force-installed over the resolved one, with the module path printed as proof.