ci: catch accidental growth in Python SDK custom patches (#3715)

## Summary

A small SDK diff can hide a large patch against generated output. Add a
custom-code gate that counts custom additions and deletions together,
using the budget and checker already on `main`.

Extend the existing two custom-code workflows and reuse their trusted
report—no new workflows or compiler changes. Keep the report comment
available when the gate fails, preserve default CODEOWNERS, and require
a separate justified, human-reviewed PR for budget increases.

Budget-only #3714 is merged; this PR is rebased onto `main`. Enable
`Castiron / budget-only change` and `Castiron / custom-code budget` only
after the tooling is on `main` and the rollout checks in
`scripts/castiron/CUSTOM_CODE.md` pass, retaining the required merge
queue. `AGENTS.md` and `CONTRIBUTING.md` contain the agent rules and
contributor policy and link to those technical details. This PR does not
activate repository rules or enable auto-merge.