Add certified maximin allocation bounds

[FlorianPfaff]

Scope

Stacked on #14. This adds an auditable finite-grid global-optimality follow-up without overwriting the frozen greedy/exchange design evidence.

• formulates each ordered residual as an infimum of allocation-linear OLS losses;
• iteratively solves a SciPy HiGHS LP/MILP master, adds violated OLS cuts, and reports a master upper bound, feasible lower bound, and explicit certificate gap;
• supports the capped continuous relaxation and exact integer count allocations;
• preserves the existing heuristic optimizer and API;
• writes and independently verifies checksum-bound certificate and paired-recovery artifacts;
• tests the integer certificate against exhaustive enumeration on a toy problem and detects artifact tampering.

The 240 cells remain independently instantiated belief conditions. A certified count allocation is not a sequential-history, reset/washout, carry-over, or physical protocol certificate.

Frozen certificates

Exact artifact head: b7e95c0d6d2fb6d2f4c3500c9f36095f8b5eb521.

• N=60 integer: LB 0.25286766545125633, UB 0.2528676654512564, gap 5.55e-17; allocation SHA-256 694a84107c1ba94f39146a05675def1b5813621fab486d7567f6711510a6fc08.
• N=45 integer: LB 0.25239583793300424, UB 0.2523958379330045, gap 2.78e-16; allocation SHA-256 bbd0796cc7c767c3388cd6c3b9522cebaed78993586aa5dfd3b353e856abe856.
• Both exact integer bounds map to rounded population observation-equivalent N_eff=45.
• The continuous 100-iteration run remains explicitly uncertified: LB 0.253106863558372, UB 0.2532561178966192, gap 1.4925e-4. No tolerance was relaxed.

Certificate SHA tables: N60 ae337d44c4b5b0ae3bbaaaf1a4981a29bffe7cbb5458104f05d19de13c313938; N45 f9e4646d32e7a89235db4a0ca6e14b4c6543782115e392b36960a63b26392ef9.

Paired recovery consequence

The exact N=60 allocation materially differs from the chronologically earlier heuristic allocation (L1 distance 100; support 15 versus 12; overlap 4; maximum cell-count change 9). A tracked generator and independent verifier reran the same five seed streams, 200 replicates per generator.

The certified allocation is worse in all five paired streams. The across-seed worst matched-pure recovery changes from 0.750 to 0.665. Therefore the exact residual-geometry certificate cannot inherit the heuristic recovery benchmark and is not promoted as a better experimental schedule.

Paired artifact SHA table: bf71ec288bba20936cdf44dccc0323e0fdaccc230c810284e30bd181741b6120; summary SHA-256: 2abde4359fcf9e6ada150931e9dbb6b74e70cd06ea989998dfe25e42ee7191ed. The independent verifier reproduced all 60 comparison rows.

Verification

Producer head c6dea54d1e8a1b702c212c83535af8a5de3ab3ea passed pycompile, Ruff, mypy, and 16 focused tests, including deterministic rerun and tamper detection. GitHub CI at that producer head passed quality, build, and Python 3.10–3.13. CI for the evidence commit is pending/monitored.