Repair Experiment 013 Stage-A capture isolation

[Labeeb2339]

What changed

• retain the NumPy-only frozen Stage-A artifact contract and sealed capture-isolation hardening
• preserve and document the retired 117d01b one-shot RULER incident; no retry, adoption, or protected-body inspection
• restore requirements/experiment013-ruler.txt to its prior canonical 798-byte LF identity without changing any of its 37 pins
• add a source-frozen, public-only canary that reserves fresh roots, invokes the generator once for exactly 16 public receipts, and fails closed across repeated byte and tree-stability authentication
• preserve experiment013-ruler-g0-de43236 as preflight-rejected: no reservation or child ran because Windows text stdout would have changed the canonical LF record to CRLF
• emit the canonical canary success record through binary stdout and authenticate the real OS-pipe boundary at exactly 174 bytes, one LF, empty stderr, and SHA-256 42d42af93655a9e9d0c41e151b7d086f85552b1ef6d4f7e0c52d8a8ba7254a5b
• keep the repository-source inventory frozen at exactly 56 paths and enforce both requirements files under contrasting Git line-ending modes

Exact local verification at 3d8449182b0d187a47c37b3859c7220a07e4e23a

• generator/canary regression: 55 passed; focused Experiment 013 cluster: 185 passed
• full locked suite: 2,142 passed, 28 expected skips
• ruff check ., generated README assets, MBPP confirmation verifier, and StateLease Stage-A verifier passed
• repeat direct 56-path source capture passed; fresh core.autocrlf=false and true clones produced identical canonical manifests
• pinned uv 0.11.31 reproducible wheel/sdist build, strict Twine, archive/worktree/Git-normalization audit, wheel RECORD, fresh Python 3.11 wheel install, installed RECORD, dependency check, import/version, and CLI demo passed
• wheel SHA-256 650e20352b8ca6bb815f94593206d0e04ec8b70010d1c5334de80a9a6fcf949e; sdist SHA-256 0cfd7ceb40a7802ce6b1051543dcd4901962b3149477e63f256d316beb2d00f4

Current authority

This remains a non-result requalification repair. Exact-commit CI must pass all five jobs before a new non-authorizing G0 tag may exist. No canary reservation, canary or official generation, final H0, identity capture, model access, Stage A, quality claim, or breakthrough claim is authorized by this PR state.