phase 5: flip loc-budget to whole-repo blocking gate [guardrail-change]

- loc-budget CI job: remove if/else PR-only guard; now runs scripts/check-loc.sh
  (no || true) on every push and PR, scanning the full repo
- sbom-scan: remove || true from grype command — high+ CVEs now block PRs
- scripts/check-loc.sh: add test_*.py / */test_*.py and *.html exclusions so
  Python test files and Jinja/HTML templates are not counted against the budget
- .claude/rules/loc-exceptions.txt: grandfather 40 remaining oversized files
  into the exceptions list (one-off scripts, docs copies, platform SDKs,
  and Phase 1 backend-compliance refactor backlog)
- ai-compliance-sdk/.golangci.yml: add strict golangci-lint config (errcheck,
  govet, staticcheck, gosec, gocyclo, gocritic, revive, goimports)
- delete stray routes.py.backup (2512 LOC)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/check-loc.sh

@@ -49,8 +49,10 @@ is_excluded() {
     */node_modules/*|*/.next/*|*/.git/*|*/dist/*|*/build/*|*/__pycache__/*|*/vendor/*) return 0 ;;
     */migrations/*|*/alembic/versions/*) return 0 ;;
     *_test.go|*.test.ts|*.test.tsx|*.spec.ts|*.spec.tsx) return 0 ;;
+    *_test.py|*/test_*.py|test_*.py) return 0 ;;
     */tests/*|*/test/*) return 0 ;;
     *.md|*.json|*.yaml|*.yml|*.lock|*.sum|*.mod|*.toml|*.cfg|*.ini) return 0 ;;
+    *.html|*.html.j2|*.jinja|*.jinja2) return 0 ;;
     *.svg|*.png|*.jpg|*.jpeg|*.gif|*.ico|*.pdf|*.woff|*.woff2|*.ttf) return 0 ;;
     *.generated.*|*.gen.*|*_pb.go|*_pb2.py|*.pb.go) return 0 ;;
   esac