ADC-687: add an honest audited-open M4 conformance gate

[wolf75222]

Scope

This stacked draft carries the exact M4 runtime/IO evidence ledger and integrates the qualified automatic Balance route from #659 while preserving its history.

Current evidence

• source matrix: 53 executable proofs, 0 deferred rows
• local official installed-package gate on macOS/MPICH: 53/53
  • 38 exact pytest proofs
  • 1 mandatory two-rank MPI scientific-output proof
  • 14 exact CTest selectors
  • 0 skip, 0 xfail, 0 deferred proof
• native rollback/retry is proven for external FieldSolver execution
• exact native selection covers owner/level/component-qualified projection and reflux terms
• fixed-binary tamper refusal, installed Program metadata, singleton-MPI external FieldSolver execution, and transactional provider evidence are covered
• installed environment: MPICH 4.1.2, Kokkos OpenMP, parallel HDF5 1.14.3, native VTK readers; pops.runtime.doctor.doctor() is healthy
• Linux CI reached 38/38 Python M4 proofs before Ubuntu OpenMPI 4 aborted in its OMPIO sharedfp/lockedfile implementation during MPI_File_open; commit c53b3d0d confines the M4 lane to the packaged non-OMPIO MPI-IO component

Acceptance boundary

Source closure and the local installed MPICH proof do not replace the required Ubuntu/OpenMPI proof. This PR stays draft until the complete installed MPI gate reruns for commit c53b3d0d with no skip, xfail, timeout, substituted reader, or MPI-IO abort. The stacked base also currently has three separate serial-Python failures outside the ADC-687 M4 matrix; those remain owned by their originating lanes.

[wolf75222]

M4 source evidence advanced without closing the final gate: b575950 + 2119b3f require the MPI ParaView proof to reopen the complete hierarchy PVD -> ordered PVTU timesteps -> every rank VTU through native VTK readers, checking geometry, U/pops_level/vtkGhostType, rho components, TimeValue, and exact leaf coverage. The audited ledger is now 46 executable proofs / 5 deferred gaps. Source checks: 16 architecture tests, Ruff, docs, and diff-check green. Native VTK+MPI execution remains mandatory in the installed gate lane, so gate_execution stays open.

[wolf75222]

M4 strict-checkpoint refusal is now provider-backed, not FailFirstRestart-backed. Commits d4c3a57 + 2ca31bf publish a real AMR checkpoint, preserve its content-addressed envelope, corrupt only the authenticated dynamic ledger contract, then traverse RestartV3.reopen, real AMR preflight and native transaction. The proof checks exact rollback of fields/topology/history/clock/counters/run identity/cursors, no residual transaction, and successful retry of the original checkpoint. Ledger: 47 executable / 4 deferred; compiled execution remains pending in gate_execution.

[wolf75222]

M4 executable-proof update, with history preserved as separate commits:

• ConsumerGraph refusal: 91b756bc1 real two-writer collision/compensation proof, f439e1a56 gate selection, cff76414b docs. It proves no partial/temp publication, byte-identical pre-existing output, exact state/time/step/cursor rollback, then successful retry publishing both writers.
• RuntimeInstance refusal: 440c9cccc real prepared FieldTopology/FieldSolver failure through pops.run, b08969900 gate selection, 8c6cf9ce0 docs. It verifies exact runtime/provider evidence rollback and successful retry on the same instance.

Source gate now reports 49 executable / 2 deferred; 18 architecture tests, Ruff, doc lint, and diff-check pass. Native installed execution remains deliberately pending the single shared build lane.