[ADC-689] Prove parity of the installed public API

[wolf75222]

What

• preserve and refresh the source→wheel proof from PR [ADC-689] Prove source-wheel public API parity #636 on current master;
• resolve the installed PoPS distribution through importlib.metadata without importing pops in the gate process;
• compare every Python/typing byte and isolated public-API snapshot across source, retained wheel, and installed package;
• authenticate the exact wheel and installed METADATA identity (Name, Version, SHA-256), reject duplicate wheel members, and bind the source snapshot version to wheel metadata;
• make release preflight require the retained public-API evidence, its exact producer digest, the final-gate wheel SHA-256, and the same installed package path as the authenticated runtime.

Why

The previous stacked proof established source/wheel/installed byte parity, but its evidence was only uploaded beside the final release evidence. It was not authenticated by release_preflight.py, so the retained proof was not cryptographically tied to the exact wheel and installed runtime admitted for publication.

Impact

Publication now fails if the installed distribution metadata differs, if the parity evidence was produced by another script, if it belongs to another wheel, or if it resolved another PoPS installation. Pure authoring, typing payload, qualified handles, and the exact root public API remain checked in isolated interpreters.

History

• explicit merge of current master into PR [ADC-689] Prove source-wheel public API parity #636;
• explicit merge of refreshed PR [ADC-689] Prove source-wheel public API parity #636 into this branch;
• seven original ADC-689 commits preserved;
• two new thematic commits for distribution identity and release-preflight binding;
• no squash, rebase, amend, or force-push.

Validation

• 38 passed: public API parity proof, final public API, no-runtime-import, release contract, and final release gate architecture tests;
• Ruff: all changed Python files passed;
• docs/check_docs.py: passed with one expected stale-dependency warning;
• git diff --check: passed;
• zero skip/xfail counted as proof.

Deliberate limits

This remains a source-level release-contract slice. It did not build or install a new native wheel locally and did not execute the tagged GitHub release workflow. That real macOS arm64/cp312 workflow remains the final proof for wheel construction, installation, codesign, and publication.