Deterministic-first Python code governance: ~75 native checks (ZR001–ZR510), explain mode, human/JSON CLI