scientific(coverage): fingerprint the prospective validation design in persisted evidence

[seonghobae]

Finding

#728/#731 now persist immutable fingerprints for the simulation scenario and exact indexed replication outcomes, but CoverageCalibrationEvidenceRecord still binds the prospective validation criterion only by the string validation_design_id.

CoverageCalibrationDesign::tepp_nominal_95_v1() owns materially scientific constants — attempted DGP count, nominal coverage, practical lower/upper coverage bounds, and maximum Monte Carlo standard error. Those constants are not serialized into the evidence record and have no immutable digest. If the implementation drifted while retaining tepp.coverage.nominal95.v1, an eventual acceptance record could carry the same design identity while being assessed under a different criterion. Persisting source_head shows which code ran, but does not make the criterion self-describing or independently comparable across artifacts without recovering source.

This is the validation-side analogue of #728's simulation-scenario drift problem.

Required RED / repair

• add a validation-owned deterministic SHA-256 fingerprint for CoverageCalibrationDesign;
• domain-separate the digest and bind the design identity, attempted DGP count, nominal coverage, practical lower/upper bounds, and maximum Monte Carlo standard error using explicit canonical lengths/counts and exact IEEE-754 binary64 bits;
• expose a pinned v1 contract so changing any criterion field without issuing a new design version changes the fingerprint;
• persist the fingerprint beside validation_design_id in CoverageCalibrationEvidenceRecord and deterministic JSON;
• bump the evidence wire schema because the persisted contract gains a new provenance field;
• do not duplicate coverage assessment arithmetic or move simulation ownership into validation_core.

Boundary

This is persisted provenance for the prospective criterion. It does not execute the 10,000-DGP study, choose an acceptable numerical-failure rate, promote a claim, or create a release. source_head, simulation scenario fingerprint, indexed outcome ledger/digest, and validation-design fingerprint remain distinct evidence dimensions.

Refs #639 #680 #725 #728 #729 #730 #731.

[seonghobae]

Ordinary-forward source repair is now on #639:

• source RED: 46e0c850db4a7d4c4dfec6edbd503faf36e60f15 adds a public contract requiring the prospective-design fingerprint and schema-v4 evidence binding;
• fingerprint owner: 1aad8a6bfaad6cc6ae3fffdc37d81c84e536b1e1 derives the domain-separated SHA-256 over design id, attempted DGP count, nominal coverage, practical bounds, and maximum MCSE using canonical u64/binary64 bytes;
• public export: 0c3de8220a8ce873725de3893011422476ee6028;
• evidence persistence/schema v4: b210abd9fc0243ebfdd5443ee12ea44cd90a5594;
• existing evidence-contract currentization: 29da26898d08f937610ed207f6673070f91b6f66;
• CHANGELOG/current exact head: 8394b34cccb10d99f659cde8ea04c4ce3470733a.

Pinned tepp.coverage.nominal95.v1 fingerprint: e48b4a504318ee18fcd32eb598232bb8bc7b63944e4285bb207ef173ca4a1286.

The RED head advanced before hosted runners executed it, so this is source-level RED evidence only. Exact-head Rust/Security/Documentation/CodeQL/Semgrep runs are currently queued; keep the issue open until current-head hosted evidence and review are available. This does not execute #680's 10,000-DGP acceptance run or define numerical-failure acceptability.