[texastony]

Issue #, if available:

Description of changes:

boto3 binds AWS credentials to a client at construction, and every boto3 client (and Session) owns its own connection pool. An application that must call KMS with per-tenant credentials therefore needs a Session and KMS client per tenant; measured at ~239 ms and ~8.4 MiB each, that does not scale to hundreds or thousands of tenants.

This adds an example that shares one connection pool across every tenant:

• examples/src/multi_tenant/kms_transport.py: KmsTransport, one per process. One urllib3 pool, SigV4 signing via botocore.auth.SigV4Auth, basic retries modeled on botocore's standard mode, and the same exception types boto3 raises (mapping mirrors botocore/httpsession.py).
• examples/src/multi_tenant/tenant_kms_client.py: TenantKmsClient, one per tenant per region. A boto3-shaped client for GenerateDataKey, GenerateDataKeyWithoutPlaintext, Encrypt, Decrypt, and ReEncrypt; it holds only a transport reference, a region, and the tenant's credentials.
• examples/src/legacy/multi_tenant_kms_master_key_provider.py: TenantStrictAwsKmsMasterKeyProvider, a StrictAwsKmsMasterKeyProvider whose regional clients are TenantKmsClients.
• examples/src/multi_tenant/design.md: the options considered and the decisions made.

This PR is the first chunk. Keyring (AWS KMS, MRK discovery multi-keyring, Hierarchical) examples and the MRK-aware/Discovery MKPs will follow separately; design.md already describes them.

Testing

• Offline: an in-memory KMS behind the transport's pool authorizes each KMS key for exactly one access key; tests run the example itself and assert which tenant signed every request. 49 pass.
• Against AWS KMS: test_i_multi_tenant_kms_master_key_provider passes. Separately confirmed that requests signed with two different credential sets share one TLS connection.
• Not yet run: the repo's pinned flake8 4.0.1 / pylint 2.13.5 (no Python <3.12 locally); current flake8/pylint with the repo configs are clean.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

• Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

🤖 Generated with Claude Code