Lock the zero-runtime-dependency invariant and add provenance to the report header

[bamdadd]

Context

report.py documents 'STDLIB ONLY: this package has zero runtime dependencies'. Nothing enforces it, and the report header records the bootstrap seed/resamples but not the Python version or a wall-clock stamp, which the portfolio reproducibility rules ask for on any results output.

Acceptance criteria

• A test asserting the package's runtime dependencies list (in pyproject.toml) is empty, so adding a runtime dep fails CI.
• The text and JSON report include the interpreter version (e.g. platform.python_version()) alongside the existing bootstrap seed/resamples.
• Determinism preserved: no timestamp is embedded in any value asserted by existing snapshot/determinism tests (if a wall-clock line is added it must be excluded from determinism assertions, or omitted from the compared region).
• uv run mypy src clean; no new runtime dependency introduced.