feat(bindings): bind host-local training losses natively

[GBeurier]

Summary

• add a validation-only DAG-ML C ABI that binds an active training-loss role and task-owned attestation from exact NodeTask JSON
• route R and MATLAB/Octave local loss execution through that native task validation while keeping tensors and functions host-local
• add native bridge builds, host conformance fixtures, CI jobs, contract metadata, and exact-JSON guidance

Architecture

DAG-ML remains the source of truth for phase filtering, role selection, and attestation validation. R and MATLAB/Octave receive the exact NodeTask JSON emitted by DAG-ML, resolve their process-local function from the native role, execute on host-owned values, and expose the attestation only after callback success. Loss and metric registries remain separate.

Tests

• cargo test -p dag-ml-core -p dag-ml-capi (749 passed, 2 ignored)
• cargo clippy -p dag-ml-core -p dag-ml-capi --all-targets -- -D warnings
• cargo fmt --all --check
• python3.11 -m pytest parity/criteria/tests/test_criteria_contracts.py -q (10 passed)
• python3.11 -m pytest parity/training/tests/test_training_contracts.py -q (143 passed)
• python3.11 scripts/validate_contracts.py --require-sibling --sibling-root /home/delete/nirs4all/dag-ml-data
• python3.11 scripts/validate_abi_snapshot.py
• python3.11 scripts/validate_release_metadata.py
• python3.11 scripts/check_so_freshness.py
• Python binding smoke test

Notes

• Stacked on feat(capi): bind task-local training losses #28 (agent/loss-cabi-task-binding).
• Local R and Octave runtimes are not installed in the development environment; the dedicated CI jobs compile and execute those bindings.