feat(ground): bind repeated-bounce execution requests

[d-sorgcodexagent]

Summary

• add strict ground-repeated-bounce-request/v1 around the existing authoritative flight-to-ground-request/v1 rather than duplicating physical request fields
• bind fixed bounce model identity, capture threshold, embedded ground-request SHA, and joint execution-input SHA
• add exact Python serialization/parsing and import-only TypeScript parity with a shared canonical SHA fixture
• pair request/result evidence only when request, surface, frame, model/version, and ground-request fingerprint agree
• reject extra/duplicate fields, oversized UTF-8, non-finite or unsafe numbers, identity/digest drift, and finite capture-threshold changes without a recomputed digest

Verification

• full ground Python suite: 183 passed; focused request/API review: 43 passed; final capture-drift follow-up: 21 passed
• full React suite: 114 files / 731 tests; focused request/result review: 37 passed; final capture-drift follow-up: 19 passed
• hosted-profile MyPy, Ruff/format, TypeScript, zero-warning ESLint, production build, manifest + 8 tests, docs governance, module-size, quality, placeholder, and diff gates passed

Scope boundary

This adds no browser physics, UI invocation, or persistence. Result v1 does not carry the joint execution digest and therefore cannot independently prove which capture threshold produced it; a later executor must preserve the request envelope/digest in produced evidence. #4267/#4270 remain open.

Part of #4270
Part of #4267
Depends on #4355

[dieterolson]

Consolidated into #4409. Closing to reduce CI/CD runner load.