feat(rate): persist and export Morris studies

[d-sorgcodexagent]

Summary

• add one strict versioned Morris workspace v1 shared by Python/PyQt and React
• preserve the exact authority base, all ten canonical factor drafts including disabled invalid raw text, bounded design controls, and optional completed-only cross-bound archived evidence
• provide atomic save/load and deterministic aggregate CSV in both presentations without claiming unavailable raw observations
• harden imports with bounded duplicate-safe parsing, deep immutability, inert imported IDs, pre-read browser limits, keyboard accessibility, and formula-neutral text CSV

Stack

• base: codex/4142-morris-react-integration / PR feat(rate): add React Morris screening workflow #4401 exact head 37fe8d33bdb4ce26465f478757dfd7f081c04372
• head: codex/4142-morris-workspace-integration exact head ee4dfecb5e0acd1c8acd1a85d68c4d3b14113408
• reviewed Python/PyQt: 8968f6f3544203029fea8e07659ab494eb050c67
• reviewed React: bcc0b2a0200725b6558abbe4ab056471e597aaa2
• merge only after protected parents land in order

Validation

• exact combined Python Rate suite: 970/970 passed serial
• combined focused Python Morris/PyQt: 122/122 passed
• Ruff, format, MyPy, 500-line module and diff gates: passed
• full React: 102 files / 726 tests passed (blob-exact reviewed tree)
• combined focused React workspace/report/actions/workflow/Variation: 97/97 passed
• TypeScript, zero-warning ESLint, Vite production build: passed
• independent exact-head topology/security/parity audit: GO, no findings
• shared fixture SHA-256: FFEB76F98DD16BB38E0C403EAFBF787131FB980C5F32AB3D8B4ECB71E74900D0

Open gates

• authority raw Morris observations are not retained and are not claimed as exportable
• UpstreamDrift replacement consumer remains open
• protected exact-head CI and dependency-ordered merge remain required
• this PR does not complete epic Epic: Ensemble variation, swing quiet zones, and sensitivity attribution #4142