feat(rate): add strict four-surface capability contract

[d-sorgcodexagent]

Summary

• add strict four-surface-capability/v1 Python contract, JSON Schema, deterministic generator, and validator
• define stable Tools PyQt, Tools React, UpstreamDrift PyQt consumer, and UpstreamDrift React consumer identities
• require exact repository/commit evidence, limitations, freshness, schema digest, and explicit unsupported-with-reason states
• deterministically cover all 33 currently declared authorities: 15 campaign programs plus 18 linked Markdown specifications
• enforce completeness so every declared capability has all four surface cells and new declarations cannot silently disappear
• normally propagate independently reviewed feat(rate-of-closure): add camera tracking and snap views #4298 camera controls and repaired flight-to-ground ancestry while preserving the unchanged feat/4199-wind-workflow base

Current exact evidence

• current exact head: 142631a90c008942bad99745e279748a7eda2ffa
• merge tree: 4270afb0a53c1e7e620538134c06b2ca9c07e970
• merge parents, in order: original four-surface child dca40c6c0168df3aa0cd0de0e5ae0ff109715b6a; repaired feat(rate-of-closure): add camera tracking and snap views #4298 parent 57942e64744a199e4fd7d604fe2eeb9faddd062a
• matrix remains 39 records / 156 cells (12 exact-pin supported, 144 source-specific unsupported)
• Python/PyQt/shared-swing: 1,589 passed; one explicit optional skip because the Rust wheel is not installed in that interpreter
• React: 110 files / 670 tests; TypeScript, zero-warning ESLint, and 194-module production build passed
• browser: 4 Playwright camera cases across desktop and constrained 2x-DPR viewports
• Rust: all 137 tools-core tests, formatting, and warning-denied Clippy passed
• hosted delta: Ruff/format on 52 Python files, pinned MyPy 1.13 on 36 production files, and Bandit on 34 source files passed
• deterministic four-surface/campaign authorities plus documentation, changed-code, size, assertion, manifest-layout, conflict-marker, and diff gates passed
• independent exact-tree review found no findings and confirmed all seven child-only source/schema/test/release assets remained byte-identical

Scope boundary and remaining gates

This remains a truthful declared-scope inventory, not parity completion. Unstructured narrative items not promoted into a campaign program or linked authority, immutable installed UpstreamDrift pins/adapters, native UpstreamDrift React routing, four-surface conformance runs, native rendered QA, protected current-head CI/review, dependency-ordered merge, and release remain open. The campaign stays specified_only, specified, and not_released; #4264 and #4260 remain open. No branch was rebased, retargeted, rewritten, or force-pushed.

Relates to #4264 and #4260.

[dieterolson]

Superseded by #4466, which consolidates all 43 open src/rate_of_closure PRs into one
branch. Closing this one is measured, not assumed: verify_coverage.sh reports
safe=43 NOT-covered=0 against consolidated/rate-closure-remainder-2026-08-13, so this
PR's head is contained and nothing here is dropped.

Stacks were folded top-down (each child into its own parent, then the parent upward), so
non-tip work is included rather than skipped — including 8067ca79a (#4171, CAD export
artifact validation) and f9afa9d96 (#4309, strict ground result playback), each of which
lived in exactly one PR and is absent from its stack tip.

The consolidation also repairs defects the merge exposed, listed in #4466: two unguarded
datetime.UTC imports that break the Python 3.10 lane, a PyQt module registry that could no
longer construct the main window, the club-assembly binding and STL/sidecar controls that had
been dropped from the wired tree, and a filelock dependency that would have failed
tests (3.11) at collection.

Reopen this PR if you need its branch; the branch itself is untouched.