Bind runs to immutable execution plans - #69

Summary

• add deterministic miniverl plan --out plan.json artifacts binding source YAML bytes, ordered overrides, accepted compatibility mappings, immutable model revisions, scanned Parquet hashes/schema/rows, exact native config and weight-free recommendations
• add miniverl run --plan plan.json, which validates plan integrity, version compatibility, source/data bytes and the sealed native config before model construction without recompiling defaults
• propagate the plan digest through run manifests, teacher-cache identity and checkpoints while preserving legacy checkpoint digest compatibility when no plan is present

Validation

• non-GPU/non-network: 2,196 passed, 9 skipped, 21 deselected; 85.01% branch coverage
• RTX 4080 GPU: 8 passed
• network: 13 passed, 2 environment-dependent skips
• focused plan/cache/checkpoint/config/runtime: 211 passed
• Ruff check/format, mypy, actionlint, strict MkDocs, text/link/release-state/generated-description gates passed
• Playwright: 40 rendered SVG instances across 1440/1024/820/390 px
• wheel and sdist passed build/Twine
• dev wheel SHA-256: ddafdd5275e5b77b38a58ec700cce4c20f86a06e5b3c8de0aaac373c998d181d
• dev sdist SHA-256: 28effafac6da0ccf4bb62f72567a664ae60daae0aa2d89534f4ef30afeeb8e6f
• frozen calculator SHA-256 remains 53fc1d4d5b7adee09618d77ad62d4086ba56b78569832d6fc7c3bcd5c2695bbc

This remains one-GPU pure forward-top-k GKD. It does not add a scientific comparison or claim distributed verl execution.