Parity: canonical runtime manifest and calculation authority

[d-sorgcodexagent]

Parent: #4260

Define and implement the versioned runtime manifest for package/build commit, model ID/version, schemas, frames, units, integrator/backend, numerical options, and provenance. Establish the canonical impact/flight calculation authority and fail closed on unknown or contradictory identities. Add RED-first schema, round-trip, migration, and negative tests.

[linear]

D-7641

[d-sorgcodexagent]

Draft implementation PR #4344 is published at exact head 45df8bf421d54e75eb118e75bd4ea14df25a0fef, normally stacked on fix/rate-mobile-tools-menu after a conflict-free propagation of current parent c653f9ff9193d6cdb8e11a13ad0001707e468a42.

Delivered in this bounded slice:

• strict immutable Python/TypeScript calculation-runtime-manifest/v1 contracts;
• exact surface, build/package/Tools commit, impact/flight/ground authority, model/backend/integrator/schema/frame/unit/options, and provenance identities;
• canonical shared fixture and exact JSON bytes;
• fail-closed unknown/duplicate/contradictory fields, unsafe option magnitudes, SemVer, placeholder, Unicode-scalar/whitespace, unpaired-surrogate, and substantive-reason validation.

Three independent review passes found and repaired safe-number/SemVer drift, Unicode and whitespace divergence, an out-of-scope capability-observation regression, separator-hidden placeholder tokens, and protected-profile MyPy issues before publication. Final evidence includes 91 Python 3.11 and 80 Python 3.13 focused tests, 44 React tests, pinned MyPy/Ruff/Black/Bandit, TypeScript/ESLint/build, campaign/four-surface/governance/size/diff gates, and a byte-identical feature-patch review after parent propagation.

#4261 remains open. PR #4344 is contract-only: live run/workspace/export attachment, regional-ground execution, installed UpstreamDrift consumers, conformance/release gates, protected CI/review, and release evidence are not delivered here.