feat(rate): add strict calculation runtime manifest

[d-sorgcodexagent]

Summary

• add the strict immutable calculation-runtime-manifest/v1 contract in Python and TypeScript
• record exact build/package/Tools commit identity plus impact, flight, and ground calculation authorities
• enforce model, backend, integrator, request/result schema, frame, unit, numerical-option, provenance, and availability invariants
• provide one cross-runtime canonical fixture and exact canonical JSON bytes
• fail closed on unknown fields, duplicate calculations/options/evidence, unsafe numeric magnitudes, invalid SemVer, placeholders, contradictory availability, malformed Unicode, and non-substantive unavailable reasons

Engineering review hardening

Three independent review passes found and repaired issues before publication:

• Python/TypeScript safe-number divergence and SemVer leading-zero acceptance
• valid non-BMP Unicode rejection in TypeScript, Python/JavaScript whitespace differences, and an out-of-scope shared canonical-number regression
• stable-ID placeholder tokens hidden beside separators plus one protected-profile MyPy error

The final contract uses mirrored Unicode-scalar and Unicode White_Space semantics, rejects unpaired surrogates, keeps MAX_SAFE_INTEGER enforcement local to manifest numerical options, and preserves the established capability-observation 1e21 wire contract.

Verification

• Python 3.11 focused contract/capability/governance: 91 passed
• Python 3.13 focused contract/capability: 80 passed
• React/Vitest runtime and flight-ground contracts: 44 passed
• pinned MyPy 1.13 with the protected CI profile
• Ruff, Ruff format, Black, Bandit
• TypeScript, zero-warning ESLint, production Vite build
• campaign/four-surface validators, docs governance, minimum-test and assertion gates
• changed-file/module budgets and git diff --check
• ordinary conflict-free propagation of current parent c653f9ff9193d6cdb8e11a13ad0001707e468a42, with an independently verified byte-identical feature patch

Scope boundary

This PR is contract-only. It does not attach the manifest to live simulation runs, workspaces, exports, regional ground execution, installed UpstreamDrift consumers, or release artifacts. Issue #4261 and epic #4260 remain open until those integrations, conformance gates, protected review, and release evidence land.

Tracks #4261
Parent epic: #4260