feat(rate): bind Simulation scrub execution authority

[d-sorgcodexagent]

Summary

• execute the exact React Simulation impact-time candidate on pointer release, keyboard range commits, and Auto tau
• retain the prior accepted scene (or an honest empty state) on bounded synchronous execution failure
• preserve and regression-test the already-correct PyQt keyboard/Auto behavior, with successful-run publication extracted below the 400-line source ceiling
• correct Simulation lifecycle manifest wording and add production Chromium plus two-DPI PyQt diagnostic evidence
• extend protected workflow path/command authority and advance the four canonical handoff/SPEC documents to 1.16.95

Root cause

React Auto tau called setTauMs(null) and immediately reran through a closure that still held the prior value. The range also reran only from mouse/touch handlers, so keyboard adjustments changed the editor without executing that exact candidate.

Validation

• full web: 124 files / 1,046 tests
• scoped Python Simulation, ball-setup, and manual-delivery lane: 107/107
• governance/assertion/workflow/manifest lane: 47/47
• Chromium production viewport evidence: 3/3 (1440x900, 1280x720, 390x844)
• PyQt rendered evidence: 2/2 (DPI 1.0 and 1.5), with identical accepted canvas hashes after planted dependency failure
• Vite build, TypeScript, ESLint, Ruff lint/format, pinned Python 3.12 MyPy 1.13, module-size, diff-check, and <=400 changed-source/test checks: green

Boundaries

Execution remains synchronous in both surfaces; this change does not invent loading, progress, or cancel states. Rendered PNGs are diagnostic rather than approved goldens. Formal AT approval, performance qualification, and the remaining #4433 tab work stay open.