Harden Track 1 runtime and release pipeline

[alan-d-smith]

Summary

• align the batch runtime with the full Track 1 participant-guide contract and runtime-injected Fireworks configuration
• merge and harden deterministic, Fireworks, validation, deadline, telemetry, and optional llama.cpp shadow components
• add exact-model, evidence-bound packaged policy activation that remains inactive without valid final-proxy evidence
• add original eight-family calibration/audit corpora and reproducible route-evaluation tooling
• add Python 3.10 quality checks plus constrained linux/amd64 container, hybrid mock-proxy, size, and public-GHCR verification

Local verification

• 559 tests passed; 1 Windows symlink test skipped
• Ruff lint and format clean
• strict mypy clean across src, eval, and scripts
• WSL Python 3.10.12 compile check clean
• nine-task local hybrid smoke covered all eight families and isolated one synthetic Fireworks failure

Routing evidence / release state

Public-development Kimi/MiniMax measurements are documented as hypotheses only. They use fully qualified public IDs, cannot be rebound to the evaluator's injected short IDs, and include no Gemma endpoint evidence. No measured policy is packaged; the first image intentionally uses the meaningful Gemma-via-Fireworks unmeasured baseline until official proxy evidence exists.