build(primaite): qualify and pin the public source and experiment profile

[Brad-Edwards]

Summary

Three bundled changes (the latter two added mid-flight at maintainer request):

1. PrimAITE qualification (build(primaite): qualify and pin the public source and experiment profile #39). Qualifies and pins the public ARCD PrimAITE source (tag v4.0.0) and one public data_manipulation experiment protocol as backend-local evidence under raes_adapters.primaite, mirroring the CyberBattleSim (build(cyberbattlesim): qualify public source profile #54) and CybORG (build(cyborg): qualify the CAGE-2 runtime profile #56) precedent. No adapter, RAES SDL, backend manifest, or conformance claim is implemented.
2. raes 3.x upgrade. raes 2.0.0 → 3.3.0 and raes-env-packs 3.2.0 → 3.6.2 (the latter hard-requires the former).
3. OpenRAE identity reconciliation. The active GitHub-repo identity RAESystem/adapters → OpenRAE/adapters after the org move.

Requirement UIDs

• (none — requirement-free qualification + maintenance run; see Traceability)

Related Issues

Closes #39

ADR Impact

• ADR-003 (single distribution + optional per-simulator extras)

Changes

PrimAITE qualification

• Add raes_adapters.primaite with load_qualification() / read_public_protocol() accessors.
• Add immutable qualification.json: PrimAITE v4.0.0 (commit 98617981…, tree 3928ab45…), a 234-file import-root digest that matches the built wheel exactly, MIT/Crown-copyright (DSTL) legal disposition, Python-3.11 clean install with setuptools==75.6.0, and a bounded do-nothing smoke (action Discrete(78), observation Box(1652,), fixed-horizon truncation at step 128, terminated always false).
• Add public-protocol.md (data_manipulation via PrimaiteGymEnv); its sha256 is pinned in the record.
• Record honest, graded findings: no PyPI/release wheel, undeclared pkg_resources/setuptools runtime dep, reset(seed) raises KeyError('torch') without the rl stack, requires-python (<3.13) vs classifier (<3.12) mismatch, undeclared click in the CLI, unpinned 133-package graph (all-permissive licenses; one transitive dep declares none).
• Add dependency-light primaite = [] extra; base and other simulator extras stay independently resolvable.
• Add tests/test_primaite_qualification.py (7 tests); wire the Step-2.5 guardrails into README, docs/index.md, and the mkdocs nav.

raes 3.x upgrade

• Bump raes and raes-env-packs pins; re-lock.
• Adapt the CybORG conformance test fixture to raes ≥3's stricter report-evidence validation (keep full case set + passed=False so the suite refuses a genuinely-failed published case, not an upstream-invalid payload).
• Re-pin the CybORG uv_lock_sha256 and update raes-env-packs pin assertions.

OpenRAE identity reconciliation

• github_repo, the check_project_services.py gate, README OpenSSF Scorecard/Best-Practices badges + issue links, docs/, mkdocs.yml, and pyproject URLs → OpenRAE/adapters; re-pin the ADR-002 identity register entry.
• Unchanged by design: the SonarCloud key RAESystem_adapters (the Sonar project did not rename) and digest-pinned historical qualification evidence (both public-protocol.md files, cyberbattlesim experiment/mapping) — these retain their authoring identity.

Test Plan

• Unit tests pass
• Configured completion command passes
• No coverage regression

Full nox -s verify is green on the final tree: hygiene, five policy checks (requirement governance skipped — requirement-free; project-services + identity gates green under OpenRAE), lint, 40 tool-tests, mypy-strict across base + cyberbattlesim + cyborg + primaite extras, the pytest matrix (240 passed / 8 skipped per extra) under raes 3.3.0, clean-install distributions + identity policy (conformance probes re-verified under raes 3.x), and the strict MkDocs build. Pre-push codex + test-quality reviews were clean (0 findings) on the PrimAITE core; the raes/OpenRAE delta was accepted on the strength of the green full-verify per maintainer decision (over-cap review declined).

Ground Control Checks

• Configured repository policy command passes
• Quality gates unchanged by this repo-only change

Traceability

• IMPLEMENTS: Issue build(primaite): qualify and pin the public source and experiment profile #39 acceptance (immutable source + protocol) ← src/raes_adapters/primaite/qualification.json, Issue build(primaite): qualify and pin the public source and experiment profile #39 acceptance (public experiment protocol) ← src/raes_adapters/primaite/public-protocol.md
• TESTS: src/raes_adapters/primaite/qualification.json ← tests/test_primaite_qualification.py

Checklist

• Code follows project coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated where stack/identity changed