Close transport and evidence invariants for v0.4.5

[0xmrma]

Summary

• bind budget reservations and leases to sealed request semantics, evidence role/round, and the authorization manifest's complete budget policy
• require origin-only base URLs for origin-form targets
• publish mrma.experiment/v9 with repeated-control pair evidence and offline statistical/verdict rederivation
• preserve v7/v8 verification compatibility while disabling new legacy generation
• update the README, model documentation, release baseline, package checks, and v0.4.5 metadata

Verification

• 369 tests pass
• Ruff passes for mrma, tests, and tools
• strict MyPy passes for all 19 v0.4 modules; corrected-core MyPy passes
• critical-runtime branch coverage: 94.26%
• corrected-core branch coverage: 86.43%
• whole-repository branch coverage: 71%
• all 49 committed semantic mutants are killed
• 22-case benchmark passes with 942 requests and zero corpus errors
• wheel and sdist build and pass Twine checks
• clean-wheel install, pip check, CLI smoke, installed-schema checks, benchmark validation, dependency audit, and hash-locked container dependency resolution pass

Boundaries

• v9 derivation starts from public privacy-safe pair classifications; it does not reconstruct raw response comparison
• v7 and v8 remain verifiable but report that statistical derivation was not performed
• semantic HTTP remains non-wire-exact
• the local Docker daemon was unavailable; the required GitHub container job is the container build gate