assurance: harden runtime capability boundary

[attractor-set]

Summary

Hardens the Alpha4 Python companion assurance boundary against same-process CPython capability aliasing without changing Network semantics.

Changes

• deny aliased dynamic runtime capabilities
• deny deferred filesystem capability acquisition
• restrict compile/exec to exact Seed-base materialization
• replace the overly broad runtime-isolation claim with:
  • RUNTIME_CAPABILITY_ISOLATION=PASS
  • PROCESS_ISOLATION=NOT_CLAIMED
• rename interface-validator evidence from INDEPENDENCE to the more precise CROSSCHECK
• add adversarial regression tests for:
  • builtin aliasing
  • bound filesystem-method aliasing
  • arbitrary compile/exec aliasing

Semantic scope

No Network semantic change.

• assurance semantic delta: NONE
• representation set unchanged: OPERATIONAL,RELATIONAL,CAUSAL
• Seed redefinition: ABSENT

Verification

Full release gate passed against immutable pinned Seed:

• tests: 59 passed
• Network TLAPS: 12/12
• profile TLAPS: 60/60
• total manifest-bound TLAPS obligations: 72
• TLC federation: PASS
• TLC federation-liveness: PASS
• bounded triangulated cases: 446/446 PASS
• identity sensitivity: 26/26 PASS
• airgap grand total: 472/472 PASS
• runtime capability isolation: PASS
• process isolation: NOT_CLAIMED
• semantic source dependency: NONE
• generator dependency: NONE
• release admission certificate: PASS
• release gate: PASS

Exact candidate identity

Base commit:

d54f34fb032a95f226668b6d708e198db1dec4a5

Commit:

3006d59fd59c31807c85ee29a073b89e6d3cf7dc

Commit tree:

1eb77d23912a9a5fda0ef38eaa5e71aa8453f569

Commit diff SHA256:

5b1e86047f8c6bcf217c1e4e400b928d28cd56e5f085dba94f40d0d753802591

The committed tree is byte-identical to the staged and release-audited candidate.