Add Python and Go vector search samples; align TypeScript with constitution

[Dina Berry (MSFT) (diberry)]

Summary

Implements the second wave of the Azure SQL vector search constitution (.github/instructions/vector-search-constitution.instructions.md) for TypeScript, Python, and Go. .NET and Java remain constitution-defined future languages and are not implemented in this PR.

Depends on: #1515 (constitution PR, not yet merged). The constitution file itself is intentionally not included in this PR — this PR reads it from origin/constitution/azure-sql-vector-search as the governing input and implements against it, so the two PRs can be reviewed and merged independently, with this one rebasing on #1515's actual merged content when it lands.

Tracking: AB#580700

What changed, per language

TypeScript (vector-search-query-typescript/) — audit and alignment, no behavior change

• Added ESLint (flat config) + Prettier, with npm run lint / format / format:check. Fixed the two findings ESLint surfaced (an unsafe as any cast on tedious's addParameter, and missing Node globals in the plain-JS typecheck helper).
• CI: added lint + format:check steps ahead of the existing type-check step.
• Added output/sample-output.txt — the real, previously captured run output already published in this sample's README, now also committed as the standalone reference file the constitution requires. Added a .gitignore carve-out so this file isn't silently re-ignored by the existing blanket output/ rule.

Python (vector-search-query-python/) — new

• pyodbc (driver) + azure-identity (Entra auth via the documented SQL_COPT_SS_ACCESS_TOKEN pattern) + openai's AzureOpenAI class (embeddings). .env-based configuration (sample.env template).
• Same table shape, same ≥1,000-row DiskANN gate (falls back to exact automatically), same JSON-cast vector binding, same dataset/query as TypeScript — implemented idiomatically, not transliterated.
• requirements.txt (>=-pinned) + requirements-dev.txt (ruff, mypy, pytest) + pyproject.toml. 22 unit tests, all passing, covering config/table-name/dataset validation without requiring Azure connectivity.
• CI: ruff check, ruff format --check, mypy, pytest.

Go (vector-search-query-go/) — new

• github.com/microsoft/go-mssqldb + its azuread subpackage (fedauth=ActiveDirectoryDefault; the driver handles Entra auth internally) + github.com/Azure/azure-sdk-for-go/sdk/azidentity + github.com/openai/openai-go/v3 with its azure subpackage (embeddings).
• Package-currency finding, verified live, not guessed: github.com/Azure/azure-sdk-for-go/sdk/ai/azopenai — the package the constitution's initial authoring named for the embeddings role — changed function as of its v0.8.0 release (2025-06-03): it's no longer a standalone client and now only supplies Azure-specific extension types to the official openai-go client. Confirmed directly against azopenai v0.9.0's own source and test files before writing this code. For a plain embeddings call, azopenai itself isn't needed at all. This requires a follow-up correction to constitution PR (ignore) Add Azure SQL vector search sample constitution #1515's ASV-CORE-37/ASV-LANG-GO-5 Go row — flagging it here rather than silently absorbing it.
• Idiomatic Go layout: cmd/query + cmd/embed binaries, internal/config + internal/hotels shared packages. Same table shape/gate/binding as every other language. 6 unit tests (go test), all passing.
• CI: gofmt -l, go vet, go build, go test.

Explicit no-live-execution disclosure

No authorized live Azure SQL Database or Azure OpenAI environment was available while authoring this PR. Python's and Go's output/sample-output.txt files and README "Expected output" sections say so explicitly and use placeholder values — they are not captured real runs and must not be treated as end-to-end validated evidence. What was validated locally instead, for both languages: full static analysis (lint/format/vet/type-check), successful build, and unit tests for every pure/testable code path. TypeScript's output/sample-output.txt is a real captured run, carried over unchanged from its existing, already-published README section.

Validation evidence

Language	Build	Lint/Format	Type-check/Vet	Unit tests
TypeScript	npm run build ✅	npm run lint ✅ / npm run format:check ✅	(part of build)	—
Python	python -m py_compile ✅	ruff check ✅ / ruff format --check ✅	mypy src ✅	pytest — 22 passed
Go	go build ./... ✅	gofmt -l . (clean) ✅	go vet ./... ✅	go test ./... — 6 passed

Scope

• Reuses the existing shared data/ (HotelsData_Vector.json) and infra/ (Azure SQL Database + Azure OpenAI Bicep) unchanged.
• No .NET, no Java, no new scenario, no documentation article.
• Updated samples/features/vector-search/README.md's language table with Python/Go rows and their validation status.

Checklist

• Branch created from upstream/master (not from the unmerged constitution branch)
• Constitution file itself excluded from this PR's diff
• TypeScript audited against every applicable constitution requirement; gaps fixed
• Python and Go implemented idiomatically per language, not transliterated from TypeScript
• Package identities verified against current official sources (npm, PyPI, Maven Central, pkg.go.dev) — one currency finding flagged above, not silently guessed
• CI added/updated for all three languages: install, lint/format, build/typecheck, unit tests
• No secrets committed; local pattern-based secret scan clean (GitHub Advanced Security scanning unavailable on this fork tier)
• No live Azure output fabricated; explicit no-live-run disclosure where applicable
• Only intended paths staged (git diff --stat reviewed before commit)
• Not yet merged — stopping here per instruction for review

[Dina Berry (MSFT) (diberry)]

CI validation evidence

This PR is from a fork, so — matching the existing TypeScript CI's established security pattern (if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) — all three new/updated workflows correctly skip on this upstream PR to prevent unauthorized minute consumption from external actors. This is by design, not a gap.

To get real automated CI execution before this PR is reviewed, I validated via a temporary same-repo draft PR on the fork (diberry#1, now closed), per the fork-workflow pattern. Results after one round of fixes:

Workflow	Result
Vector Search TypeScript — Build	✅ pass
Vector Search Python — Build	✅ pass
Vector Search Go — Build	✅ pass

Two real issues were caught and fixed this way (commit bbb57f58):

1. Go: go.mod's go directive was auto-set to 1.26.1 by the local toolchain used to author the sample, which is newer than CI's pinned go-version: "1.25" (matching the constitution's stated Go 1.25+ minimum). Fixed via go mod tidy, which reset it to 1.25.0 and also correctly split direct vs. indirect requires.
2. Python: ruff format --check . scans embedded Python code blocks inside README.md by default and wanted to reformat one — which would have altered published documentation prose. Added extend-exclude = ["README.md"] to pyproject.toml, matching the doc-vs-code formatting boundary already established for TypeScript's Prettier config.

All three languages' full local check suites (build, lint/format, type-check/vet, unit tests) were re-verified green after these fixes, and the fork's CI runs above are the independent, automated confirmation of the same result.