fix(runtime): make FieldViewDescriptor fail closed (ADC-683)

[wolf75222]

Stack

This draft is intentionally stacked on #619 (db88e5bd). It is an independent, bounded ADC-683 slice and preserves two thematic commits:

1. 027c8bba — exact Python/C++ launch contract;
2. 0ac49421 — Python/C++ refusal proofs.

Gap found

FieldViewDescriptor already carried strides, ghosts, patch identity, layout and ownership, but the launch gate authenticated only dimension, extents, centering, scalar and memory space. Runtime support for layouts, ownership and the generic-field-view capability was also emitted but never consumed.

What this changes

• require matching artifact/runtime proofs for every field-view capability;
• require generic_field_view to be an exact true boolean proof;
• reject unsupported layout and ownership before kernel entry;
• require field ghosts to leave a positive interior extent;
• reject duplicate actual or expected field names;
• compare every declared descriptor property against an expected launch contract: dimension, extents, strides, centering, ghosts, scalar, memory space, patch, layout and ownership;
• authenticate component field-view capabilities on the pre-dlopen route as well as at launch.

No ABI structure or manifest schema changes are introduced; this only makes existing metadata authoritative.

Validation

• 30 targeted Python runtime/platform tests passed;
• Ruff and py_compile passed;
• changed C++ files pass clang-format --dry-run --Werror;
• the updated C++ header instantiated successfully with clang++ -fsyntax-only;
• docs lint passed (one pre-existing stale-docmap warning);
• git diff --check passed.

The source test used the already installed matching _pops extension only to satisfy unrelated package imports; no build or install was modified.

Explicit non-claims

• This does not close ADC-683.
• It does not claim completion of the process-global MPI/device/IO audit.
• It does not claim production 3D or GPU support.
• It does not replace the full native CPU/GPU and Uniform/AMR acceptance matrix.
• The communicator-owned runtime work remains in the dependent draft ADC-683: scope native collectives to execution communicators #619.