Add exact one-step policy sensitivity evidence

[omar07ibrahim]

Outcome

Adds an exact, entropy-free one-step policy-minimum sensitivity analysis to the Python API and CLI, with text, JSON, and CSV contracts plus source-bound visual evidence.

What is reviewable

• exact baseline and one-class-at-a-time relaxed counts from bounded integer dynamic programming;
• independently checkable reduced baseline/relaxed fractions and policy fingerprints;
• explicit boundary: one step only, effects are not additive, no candidate, no entropy;
• a pure fail-closed SVG renderer and a real deterministic CLI transcript renderer;
• generator, independent evidence checker, distribution attestation, README workflow, and negative-path tests.

Evidence contract

• 27 manifest-recorded artifacts are bound to 39 source files on final head 36aab7fd69f6f59588e75278cfe0d475389424ed.
• New evidence: policy-sensitivity.json, policy-sensitivity.txt, a 1600×1366 real CLI capture, and an 1800×850 exact-impact SVG.
• The hosted candidate from Verify run 31325386816 passed recapture and fail-closed drift inventory before byte-for-byte adoption.
• Independent ZIP validation checked every path, regular-file mode, byte count, SHA-256, MIME, image geometry, canonical manifest encoding, source binding, and common secret markers.
• The README embeds 15 real/reproducible visuals with non-empty alt text and valid repository paths.

Verification

• Python 3.11, 3.12, 3.13, and 3.14: 316 tests per runtime.
• 595 statements and 144 branches at 100% coverage; Ruff, formatting, and strict mypy clean.
• Canonical distribution rebuild and installed-wheel smoke passed.
• Final browser replay was byte-identical with a clean checkout: Verify run 31326047648.
• CodeQL Analyze (actions) and Analyze (python) passed: run 31326045169.
• Independent inclusion–exclusion recomputation matched the baseline, all four relaxed totals/additions, and every reduced fraction.
• Open code-scanning, Dependabot, and secret-scanning alerts: 0 / 0 / 0.
• 17 linear commits, behind=0; every author and committer is Omar Ibrahim, with no co-authors.

No password is sampled by this analysis or its evidence pipeline.

Post-main verification

• main is the exact reviewed head 36aab7fd69f6f59588e75278cfe0d475389424ed; PR Add exact one-step policy sensitivity evidence #8 closed as a fast-forward with no merge commit.
• Post-main Verify run 31326474561 passed all six jobs, including byte-identical Chromium recapture.
• Post-main CodeQL run 31326474180 passed Analyze (actions) and Analyze (python).
• main requires those eight exact checks with strict mode, admin enforcement, linear history, resolved conversations, and no force-push or deletion.
• Open code-scanning, Dependabot, and secret-scanning alerts remain 0 / 0 / 0.