Bind stacked-pool CD-vintage provenance for the release contract

[MaxGhenis]

Bind stacked-pool CD-vintage provenance into the pool → release contract

The candidate-chain smoke exposed a post-#741 contract gap: the release unconditionally verifies congressional-district vintage-crosswalk provenance in its input pool (_assert_cd_vintage_support_matches), but the stacked pool had no mechanism to carry it — no CLI authority input, no H5 attrs channel — and the guard's reader assumed a household/table layout the nullable publisher forbids. The post-#741 pool→release chain had never been run end to end; full code-cited analysis is committed on the candidate-25pct-runbook branch (experiments/candidate_25pct/cd_vintage_provenance_defect.md).

This PR implements the five-part contract:

1. Explicit, pinned household-CD authority on the stacked-pool CLI (current-vintage crosswalk + geography assignment input), running after source assembly per the operator boundary.
2. Authority, vintage, assignment algorithm and seed bound into checkpoint identity; assignment provenance recorded in the terminal manifest.
3. Nullable H5 publication gains an atomic root-attrs channel for the crosswalk sha and target vintage.
4. The release preflight reads the fixed-nullable representation through the shared format-aware reader — what is checked is unchanged; only how it reads.
5. A real fixture-sized stacked-pool→release-preflight integration test (replacing mocked-dict coverage).

Anti-rot chain complete: 42,120/42,120 fields, 49 claims, 41/41 inventory checks. Suite: 7,241 passed, 77 skipped, 0 failed; ruff and generators clean. No production build; the logbook chain untouched.

Authored by sol (codex-6); defect discovered by the 1% candidate smoke; reviewed by Claude.

🤖 Generated with Claude Code