feat: bootstrap and runtime_context

[LucasAlvesSoares]

Description

Introduces sap_cloud_sdk.core.runtime_context — a provider-agnostic runtime context system that lets SDK modules (auditlog, telemetry, and future modules) read caller-identity information (tenant, user, trigger type) without coupling to a specific auth provider or HTTP framework.

Key design decisions:

• RuntimeContext is an immutable typed bag keyed by ContextKey[T] instances — no fixed fields, fully extensible by any module defining its own keys.
• ContextProvider protocol separates extraction logic (IAS JWT, SAP headers) from framework concerns.
• RequestEnvelope is a framework-agnostic carrier (headers, body, metadata) that providers read from — they never touch Starlette, Flask, or gRPC types directly.
• FrameworkAdapter registry decouples bootstrap() from framework-specific code — new frameworks are added by registering an adapter, never by editing bootstrap.
• bootstrap(app) is the single user-facing entry point, exposed at sap_cloud_sdk.bootstrap.

Built-in providers: IASContextProvider (IAS JWT → tenant/user) and HeaderContextProvider (x-sap-origin → trigger type).
Built-in adapter: Starlette/FastAPI.

Type of Change

• New feature (non-breaking change that adds functionality)

How to Test

uv run pytest tests/core/unit/runtime_context/

1. Bootstrap the SDK in a Starlette/FastAPI app:

   from sap_cloud_sdk import bootstrap
   bootstrap(app)

2. On an authenticated request, read context from any module:

   from sap_cloud_sdk.core.runtime_context import get_context, TENANT_ID, USER_ID
   ctx = get_context()
   assert ctx.get(TENANT_ID) is not None

3. With no Authorization header, get_context() returns an empty RuntimeContext and all keys return None.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Additional Notes

• sdk_context, async_sdk_context, and set_context are intentionally not exported from the public API — they are internal utilities used by framework middleware.
• The FrameworkAdapter registry and ContextProvider protocol are both exported for third-party extensibility.
• Future work: bootstrap will absorb auto_instrument() once the app-level-instrumentation branch lands, making it the single SDK setup call.