assurance: harden runtime capability boundary

[attractor-set]

Summary

Hardens the Alpha4 Python companion assurance boundary against same-process CPython capability aliasing without changing Runtime semantics.

Changes

• deny aliased dynamic runtime capabilities
• deny deferred filesystem capability acquisition
• restrict compile/exec to exact Seed-base materialization
• replace the overly broad runtime-isolation claim with:
  • RUNTIME_CAPABILITY_ISOLATION=PASS
  • PROCESS_ISOLATION=NOT_CLAIMED
• propagate the narrowed capability/process-isolation contract through release admission and public release audit
• rename interface-validator evidence from INDEPENDENCE to the more precise CROSSCHECK
• add adversarial regression tests for:
  • builtin aliasing
  • bound filesystem-method aliasing
  • arbitrary compile/exec aliasing

Semantic scope

No Runtime semantic change.

• assurance semantic delta: NONE
• representation set unchanged: OPERATIONAL,RELATIONAL,CAUSAL
• Seed projection: STUTTER
• Seed redefinition: ABSENT

Verification

Full release gate passed against immutable pinned Seed:

• tests: 37 passed
• Runtime TLAPS: 22/22
• bounded paired cases: 2420/2420 PASS
• airgap structural total: 7260/7260 PASS
• identity sensitivity: 5/5 PASS
• airgap grand total: 7265/7265 PASS
• runtime capability isolation: PASS
• process isolation: NOT_CLAIMED
• semantic source dependency: NONE
• generator dependency: NONE
• release admission certificate: PASS
• public release audit: PASS
• release gate: PASS

Exact candidate identity

Base commit:

e12595761ba429c50b0a20e873458381da4de333

Commit:

d99c6dccffbf5fa7142720892885e143df5d206e

Commit tree:

9ef28b89da6eed629a539b0196d1a1bd24e0b1f3

Commit diff SHA256:

071e509e7bfc9add85138018d4d588dd959ef753c9ce686c13f220d5bb50114b

The committed tree is byte-identical to the staged and release-audited candidate.