Seal one final CEX candidate before holdout promotion

[proerror77]

Change

• Freeze one immutable four-stage CEX candidate only after baseline, subset-MCTS, walk-forward, and event-level L2 replay pass.
• Enforce a unique final precommit and exactly-once sealed-holdout claim/receipt; retries read back the receipt, conflicts fail closed, and failed holdouts create no bundle or promotion.
• Reuse the existing StrategyBundle and PromotionRecord lineage for the promoted four-stage strategy, with no deployment or order authority.

Issue relationship

Closes #604

Validation

• cargo test --quiet -p alpha-domain -p alpha-engine -p alpha-store -p alpha-harness --locked (62 + 85 + 147 + 39 passed; the existing credentialed live-LLM test remains ignored)
• cargo test -p alpha-store --locked tests::concurrent_cex_sealed_holdout_claims_have_one_winner -- --exact
• cargo test -p alpha-engine --locked formula_evaluator::tests::walk_forward_evidence_ignores_holdout_mutations -- --exact
• cargo clippy -p alpha-domain -p alpha-engine -p alpha-store -p alpha-harness --all-targets --locked -- -D warnings
• cargo fmt -p alpha-domain -p alpha-engine -p alpha-store -p alpha-harness -- --check
• git diff --check

Runtime impact and rollback

Research/control-plane only. This does not activate Paper, Shadow, or LiveSmall. Roll back by reverting ff7b16ba84cfe9dc2b0da93318da371d6c00b26f.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e0246bf6-aafb-49d0-8265-f252504ee917

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff7b16ba84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[proerror77]

CI follow-up bf91eec: reproduced the Rust Workspace failure with the exact seven-package command. The failure came from treating typed semantic hashes as registry JSON hashes under the larger serde_json feature union. The store now validates each reference in its declared identity domain. Exact CI command passes locally: alpha-domain 62, alpha-engine 85, alpha-harness 147, alpha-store 39, plus onnx-evaluator/harnessctl/research-ml tests; zero failures.