Freeze integrated 0.16.3 calibration source

[TheGreenCedar]

Context

All 0.16.3 support work is integrated before this release lane, including PRs #1581, #1622, #1627, and #1628. Every calibration and qualification receipt from an earlier head is invalid.

The final calibration collected only the seven runtime constants from three fresh Metal server generations. The checked-in freeze is byte-for-byte reproducible from those raw records and is the sole source change after calibration.

Frozen candidate

• Calibration source: ac2d788bd1de84ad7cc241f8d2a7efdabf8c9d35
• Calibration source tree: 88583ad49a26f38cfb5f00aee6aee0236a70c833
• Frozen candidate: 54b4067e36ecd7dda1a0710bff1099dc0f58d726
• Frozen candidate tree: b13c24444294dff87eeffe827a5577d9a2005b9b
• Sole changed path: crates/codestory-llama-sys/per-user-embedding-server-constant-set.json
• Calibration bundle SHA-256: 9c9476f3098c7836394d84089a7856858c1c9eda7b6a8c0bc482796adc72f683
• Frozen constant-set SHA-256: 6a7880301bab68fc1226b978858f116c6c3fc8a2eeacf8eb1f081974b88311d8

Verification

• independent calibration-source workflow hostile matrix: 323/323 passed
• independent freeze-barrier matrix: 38/38 passed
• workflow policy, release claim, closeout, and evidence contracts: 1,402/1,402 passed
• packaged proof self-test, release version validation, and actionlint: passed
• calibration-source acceptance: run 30590635619, Windows probe 15s
• Metal calibration and assembly: run 30590903374, 2m14s end to end
• deterministic local reassembly reproduced both bundle and frozen constant-set bytes exactly
• release-lineage validator passed with the generated constant set as the only changed path
• frozen-candidate acceptance: run 30591167245, hostile matrix 2m09s and Windows probe 15s
• frozen freeze receipt: 890a70f3072ed463106e4188437fd80dd473ca37d257a87a3ad43c7f219e5c87
• one broad source proof: run 30591388832 in progress on the frozen candidate

The pre-calibration broad dispatch 30590819821 failed in the resolve step because its receipt phase was intentionally calibration_source; no build or test job ran, and it was not retried.

Release handoff

• Final intended source head: 54b4067e36ecd7dda1a0710bff1099dc0f58d726
• Known future source changes: none
• Proof-triggering actions: the two acceptance barriers, one Metal calibration, and broad source run 30591388832
• Reusable evidence: exact-head focused checks, calibration run 30590903374, deterministic selection and lineage validation, frozen-head acceptance, and the frozen receipt above
• Invalidated evidence: every source, calibration, package, hardware, or qualification receipt from an earlier head
• Currently running workflows: only the one broad source proof above
• Next permitted mutation: none; after the broad source proof, qualification may consume calibration artifact embedding-calibration-bundle-ac2d788bd1de84ad7cc241f8d2a7efdabf8c9d35 from run 30590903374

Closes #1558

[TheGreenCedar]

The frozen candidate fb5cf762252e05237a76221f2d88437645b35462 is invalidated for release. Its one broad source proof passed in 12m30s and will not be rerun on that head. Qualification authenticated the exact packages and passed real Metal/Vulkan execution, but exposed two harness defects:

• Windows: the resident server inherited captured pipe handles, so the synchronous worker call returned only after the legitimate 60-second true-idle exit. A 5.5-second native probe against the exact archive proved the worker output was ready at 2.42s and a snapshot then completed in 27ms. Tracked in Prevent resident embedding servers from holding worker capture pipes #1625.
• macOS: all metrics and all eight lifecycle/fault scenarios passed, including true-idle at 60,005.15ms under the 62,500ms bound. Retention then mislabeled the warmed qualification model cache from the earlier cold bootstrap state. Tracked in Retain qualification model-cache state from qualification evidence #1626.

The review-accepted proof label is removed. No workflow is running. No unchanged-head rerun or new calibration will be dispatched. Both focused support lanes start from current dev/codestory-next; after they merge, this release lane will be rebuilt on the final integration head and calibrated once.