feat(variation): execute bounded Morris designs

[d-sorgcodexagent]

Summary

• add a shared, UI-neutral Morris execution adapter over validated physical designs
• preserve explicit hit, no-impact, and numerical-failure availability without fabricating impact or shot outputs
• provide deterministic bounded serial/parallel execution, canonical progress every eight samples plus final, cooperative cancellation, and named resource caps
• update SPEC 1.16.26 and all three canonical Rate of Closure handoffs

Verification

• 27 focused Morris execution tests
• 136 full variation tests
• Ruff check and format
• hosted-style MyPy on changed production sources
• changed-file 400-line, function <=50, signature <=4, diff, import, and detect-secrets gates
• independent exact-commit engineering review: GO, no actionable findings

Scope boundary

This is shared execution infrastructure only. Rate simulation binding, PyQt/React presentation, export workflow, and UpstreamDrift consumption remain explicit follow-up scope.

Tracks #4142
Tracks #4144