Remove CPU calibration and freeze runtime constants only

[TheGreenCedar]

Context

CodeStory does not support CPU embeddings. The previous calibration path still carried a hosted Linux CPU cell and repeated the complete packaged qualification harness three times, mixing runtime-constant selection with lifecycle, fault, idle, memory, quality, and accelerator qualification.

Base: 2b97dd8b356a56e1def9018beae6fc99c3f23c83
Head: 0944b74be6feb349c8b9ae3b4d0761dd49851815

What changed

• Removes hosted Linux CPU calibration and makes protected Apple Silicon Metal the sole required calibration cell.
• Keeps protected Linux Vulkan as optional standalone evidence that cannot join constant selection or block assembly.
• Adds a constant-only producer: three fresh server generations, one sample per metric per run, one archive authentication/unpack, one project/model setup, and one shared Cargo build/package boundary.
• Separates the seven runtime constant groups from frozen-candidate thresholds. True-idle qualification uses the fixed 60-second product timeout plus a 2.5-second observation grace.
• Moves lifecycle, fault, memory, quality, accelerator, and true-idle proof to one frozen-candidate qualification run per available GPU platform. Metal produces the exact quality handoff consumed by required Windows Vulkan; Linux Vulkan is standalone and optional.
• Removes the public CPU selector, makes package manifests declare cpu_fallback: unsupported, and rejects CPU identities in calibration, qualification, benchmark, evidence, and release-proof contracts.
• Hardens workflow policy against CPU selectors, qualification work during calibration, 3x3 sampling, repeated setup/build/package/harness work, hidden Linux waiters, dead-code decoys, and skipped or rebound closeout checks.
• Updates the release claim graph, measurement protocol, package proof harness, docs, and test-only CPU fixture seam together.

How to review

1. Start with release-claims.json and the calibration/qualification assertions in .github/scripts/check-workflow-policy.mjs.
2. Review the calibration and qualification routes in packaged-platform-pr.yml, then the Metal and Linux reusable workflows.
3. Review constant_calibration.py and the new Rust constant-calibration driver for the one-setup/three-fresh-generation boundary.
4. Review the measurement protocol and unfrozen constant-set split.
5. Run the hostile workflow-policy mutations; they execute the evasion shapes rather than checking only named examples.

Verification

• Two independent cross-boundary reviews accepted the final exact tree after executing production CPU probes, requested mutations, adjacent evasion shapes, and the post-proof lint corrections.
• Exact-head source proof 30480794311 passed on 0944b74b: 2,357/2,357 tests, 3m48s compile, 36.7s all-target/all-feature clippy, 131.6s test execution, 7m25s full-source job.
• Retrieval generalization completed in 42 seconds in that source proof.
• Workflow policy: 976/976 tests; policy validator passed.
• Requested mutation classes and adjacent dead-decoy, closeout metadata, route rebinding, and hidden Linux waiter attacks all fail.
• cargo test --locked -p codestory-bench --lib: 30/30.
• cargo test --locked -p codestory-cli --test architecture_contracts: 14/14.
• Focused CLI product rejection and test-support smoke tests passed.
• Packaged proof self-test and package self-test passed.
• Release claim graph: 38/38; digest 960e7071ba1e97425a9c0be13dc107dd35374bd8e9a6ed49fc522d1aa85062ac.
• Benchmark/evidence contract tests, release cell/closeout/evidence tests, actionlint, release version validation, docs links, Rust formatting, syntax checks, and git diff --check passed.

Remaining proof

No calibration or hardware workflow has been dispatched from this branch. After merge, the release lane still must run and time the real Metal calibration, apply the generated constant set as the sole post-calibration source change, and qualify the frozen candidate. Calibration-input digest reuse is intentionally left for a follow-up.

Refs #1597

Closes #1603