Add a public portable audit API and offline SV replay CLI

[iskandr]

Sid audit evidence can now be preserved, moved and replayed from an installed Isovar package without the original machine paths or a repository/LLM session. The public AuditBundle Python API and isovar audit-bundle / isovar-audit-bundle CLI create and verify manifests, pack/restore tar.gz backups, import existing Sid regional inputs and replay structured SV RNA plans offline. Generic file bundles and documented replay plans support other datasets too.

Original receipts and reconstruction bytes are retained. Runtime files resolve through logical names; complete replay output is compared with the frozen reconstruction. Changed inputs, software identities, misspelled plans and corrupt resume checkpoints fail explicitly. Incomplete/unassessable outcomes and product/geometry/orientation identities remain visible. The implementation calls the existing reconstruction engine and does not add a consequence model or a second small-variant pipeline.

The selected Sid inputs are preserved in three movable bundles: 239 focused vaccine/control files, 535 additions files (including eight pinned annotation files), and 34 dense-control files. Their 60 completed SV views, frozen manifests, archive identities and installed-wheel proof are documented in the preservation report. All three backups total 2.02 GiB and remain in durable local storage; no whole RNA library was downloaded. API/CLI guide.

Validation: ./lint.sh, git diff --check and all 5,794 tests pass. Real original-read regressions restore after deleting the original directory, preserve the expected PARD3B sequence/four full-ORF witnesses and acquisition limitations, and reject archive/input/checkpoint corruption. A clean built wheel installed in a separate environment ran outside the checkout with Python isolated mode and networking blocked: it restored the real focused archive, exactly reproduced the entire ONT T2 TPST1–CRCP reconstruction (172 full-interval fragments / 139 barcode labels), and resumed through the installed CLI. Native result tuples are normalized at the JSON checkpoint boundary. Import verifies repeated annotation pins once per unique file while still enforcing expected pins during copying, avoiding the measured 1.74 TB of redundant hashing.

Shipped: merged at 5bfd7b5649cffc03b257ded87f793c9e9cb2fd57 and Isovar 1.45.2 is live on PyPI. CI is green on Python 3.9, 3.10 and 3.11. The required clean-master ./deploy.sh passed lint and all 5,794 tests, verified both published artifact hashes and pushed v1.45.2 at the merged commit. A normal PyPI install into the isolated environment passed the source/dependency identity check and resumed the exact frozen result through the public Python API and installed CLI outside the checkout, with Python networking blocked. The wheel guard also detected an obsolete module inherited from an existing developer build/lib; validation then used a clean checkout, consistent with deploy.sh. That separate incremental-build problem is tracked in #454; existing developer build artifacts were preserved.

Fixes #440.
Fixes #452.
Fixes #453.

[coveralls]

coverage: 96.092% (-0.5%) from 96.549% — feature/portable-audit-bundles into master