research(episodes): bind candidates to the v0.6 baseline contract

[stacknil]

Summary

• replay the declared v0.6 adjacent-gap and best-count baseline before candidate evaluation
• reject unsupported rule/grouping/boundary contracts and semantically stale baseline evidence
• reject noncanonical rule scalar types before value coercion
• canonicalize finding identity to UTC so equivalent offsets remain identical

Why

The delayed review of #115 showed that internal oracle cross-references were not enough: a stale baseline or unsupported rule could still produce a valid-looking candidate artifact. This PR extracts the source-binding prerequisite so the larger oracle change stays reviewable and below the repository's substantive-change threshold.

How to validate

python -m ruff check scripts/episode_baseline_contract.py tests/test_episode_candidate_baseline_contract.py
python -B -m unittest discover -s tests -p "test_episode_candidate*.py" -v
cmake -S . -B build -D CMAKE_BUILD_TYPE=Release -D BUILD_TESTING=ON -D LOGLENS_WARNINGS_AS_ERRORS=ON
cmake --build build --config Release
ctest --test-dir build --build-config Release --output-on-failure

Expected: Ruff passes, 10 research tests pass, and all 7 CTest entries pass.

Design decision

Treat the committed baseline as executable evidence, not a trusted count. Candidate v1 is explicitly limited to the sanitized brute_force / source_ip / inclusive-window contract. The validator replays v0.6 segment and first-maximum selection semantics, then compares the declared segments, selected window, finding identity, and excluded-event partition.

Main risk

The Python replay is a research conformance model, not the production detector. Its first selected finding is locked to the existing v0.6 finding ID, and unsupported rule families fail closed rather than borrowing brute-force scoring.

Compatibility impact

None for Detector::analyze(), loglens.report.v3, the CLI, configuration, or released behavior. This adds a standard-library-only research helper and tests.

Rollback path

Revert the baseline-contract commit set. No runtime state, migration, report consumer, dependency, or release artifact is involved.

Review policy

Merged after the delayed review, the noncanonical scalar-type regression, fresh current-head CI/CodeQL (11/11), and final diff review. #115 and #116 were subsequently retargeted and merged in dependency order.

[stacknil]

Final current-head review for 8e23d902fbf2c36095d7ed9b18a1a42a5a703987 is complete.

• Design decision: keep baseline replay as an independent v0.6 conformance model and fail closed on noncanonical JSON scalar types (subject string, integer threshold/window, Boolean terminal flag).
• Main risk: the research contract could drift from the fixture or accept coercible-but-schema-invalid inputs. The delayed diff review caught that exact scalar-coercion gap; the implementation and regression test now reject it.
• Compatibility impact: research tooling, tests, and ADR only; no runtime detector, stable report schema, CLI, or released artifact behavior changes.
• Rollback path: revert the research(episodes): bind candidates to the v0.6 baseline contract #117 merge commit. The dependent oracle/schema PRs remain separate and are not required for the current released behavior.

Fresh evidence on this exact head:

• GitHub required/status checks: 11/11 successful; merge state CLEAN
• python -m ruff check scripts/episode_baseline_contract.py tests/test_episode_candidate_baseline_contract.py: passed
• python -B -m unittest discover -s tests -p "test_episode_candidate*.py" -v: 10/10 passed
• strict MSVC /WX build: passed
• CTest: 7/7 passed
• git diff --check origin/main...HEAD: passed
• Gitleaks over origin/main..HEAD: no leaks
• final diff review: no unresolved findings