feat(rate): retain variation observation authority

[d-sorgcodexagent]

Summary

Child of #4403 for issue #4142. This preserves the exact parent and adds three dependency-ordered correctness slices:

• strict lossless raw Morris scalar-observation authority with deterministic design/sample identities, typed outcomes, bounded diagnostics, immutable strict parsing, symmetric pre-materialization resource caps, report/raw recomputation binding, and weighted ephemeral retention;
• lossless PyQt VariationPlan v2 load/build/save for custom spec IDs, temporal/spatial loci, exact per-field numeric authority, and correlation/covariance groups, with atomic preflight;
• pairwise-finite Python/React OAT and Spearman semantics, including explicit unavailable dominance/normalization behavior.

The aggregate report and job-envelope v1 wire contracts remain unchanged. Raw UI transport/export and complete event/state/torque trace authority remain open, so this PR does not claim #4142 completion.

Verification

• 355 focused Python/PyQt variation, Morris, plan, and request tests passed.
• 728 complete Rate React tests passed.
• React production build, TypeScript, ESLint passed.
• Ruff check/format and focused MyPy passed.
• Changed-file 500 LOC, diff, conflict-marker, and documentation gates passed.
• Independent exact-head adversarial review: GO at ee4c34f5c339a9b180f9e6a70580cf24ca17d6cf.
• Standalone PyQt and React apps launched from the exact committed head; React is available at http://localhost:5193/.

Release constraints

• Base remains codex/4142-morris-workspace-integration at feat(rate): persist and export Morris studies #4403 exact head ee4dfecb5e0acd1c8acd1a85d68c4d3b14113408.
• Merge only through normal protected dependency order after all parent PRs land and required current-head checks complete.
• Do not pin UpstreamDrift #8358 until the final immutable Tools main commit exists.