feat(rate): harden variation persistence and async execution

[d-sorgcodexagent]

Summary

Advances #4142 with one reviewed child containing three dependency-aligned slices:

• strict bounded reader/writer closure for the complete Rate ensemble v1 authority, including typed hit/no-impact/failure evidence, immutable arrays, scientific resource limits, scalar/status/trace binding, and fail-closed decoder/writer behavior;
• confidence-scaled 3D position ellipsoid and ranked quiet-zone metric contracts with finite PSD geometry, exact df=3 chi-square scaling, explicit adequacy, and RMS/principal-sigma/volume choices;
• cancellable asynchronous React Monte Carlo execution in a per-study worker with determinate progress, immediate rerun, stale-generation protection, request/result validation, and single-settlement transport cleanup.

The final independent review also closed a typed/wire-domain mismatch: complete trial output scalars reject booleans/non-real values and normalize accepted NumPy real scalars to finite built-in floats before authority binding and JSON export.

Local evidence at exact head 3eb9dfce23b38e956c8cdc737682a5893a27afc4

• 1,200/1,200 Python/PyQt/shared tests passed before the final scalar-domain correction;
• 239/239 affected shared-variation, adapter, and persistence tests passed after that correction;
• 743/743 React tests passed;
• CI-pinned Mypy 1.13, Ruff, Ruff format, TypeScript, ESLint, Vite production build, documentation governance, changed-test assertions, diff check, and changed-file size gate passed;
• three independent exact-head reviews returned GO for ordinary publication.

Deliberately open

This PR does not claim the full variation epic complete. Browser/PyQt archive import controls, React reader parity, chunked/streaming large-ensemble storage, full event/impact/state/torque authority, localized perturbation execution, UI selectors/rendering for the new dispersion metrics, and real Playwright/PyQt screenshot regression remain open. The outer ensemble schema remains strict v1; unknown-version rejection is a future-migration policy, not a migration implementation.

Stack/release

Draft child of #4404. Preserve the ordinary protected dependency order. Do not merge until the parent stack lands and this exact head has green required checks.

[d-sorgcodexagent]

Protected-run follow-up at 2c923fdd94ede6064cffe4847cbb56088cd78896:

The first exact-head quality-gate failure was actionable and confined to eleven Mypy diagnostics in two NumPy boundary modules under the hosted Python 3.12 / NumPy 2.3.5 / Mypy 1.13 combination. The correction adds explicit array annotations/casts and converts finfo values to built-in floats before arithmetic; runtime, numerical, and wire behavior are unchanged.

Local reproduction of the exact hosted dependency combination now passes all nine changed production modules. Focused reader/dispersion tests pass 61/61, Ruff/format and docs governance pass. One normal fast-forward push started the new exact-head checks; no manual rerun was triggered.