feat(variation): validate Morris reports in TypeScript

[d-sorgcodexagent]

Summary

• give the Morris report wire contract an explicit stable schema ID and version
• add a strict immutable TypeScript parser and typed model for the Python-produced report
• validate exact fields, status/availability/adequacy vocabularies, null semantics, units/frame/locus/bounds/seed/grid provenance, source-target completeness, and honest denominator partitions
• enforce Morris moment identities with producer-clamp-aware, overflow-safe numerical validation
• reject custom prototypes, control-character IDs, collision-prone identities, malformed matrices, impossible metric tuples, and huge derived values
• update SPEC and all three canonical Rate of Closure handoffs in the implementation/fix commits

Scope boundary

This PR consumes and validates the shared payload only. It does not implement UI, export, simulation execution, or UpstreamDrift integration, and it does not touch the parent #4280 variation UI/export code.

Validation

• focused TypeScript contract: 51 passed
• full frontend: 92 files, 602 tests passed
• TypeScript type-check: passed
• ESLint: zero warnings
• Vite production build: passed (166 modules)
• focused Python Morris producer tests: 16 passed
• structural, minimum-test, documentation-governance, SPEC, handoff, and diff gates: passed
• independent adversarial contract review: GO

Stack

Base: codex/4142-global-sensitivity at f08494f3a2698ddd69f7452dfdb1e70765388ef8 (draft PR #4393). Preserve parent order; do not retarget or merge this child before #4393 and its existing parent stack.

Tracks #4142 and #4144.