Implement amendments 11-13: entrants, partitioned mass, declared tolerance

[MaxGhenis]

Stacked on #847 (retarget to main once it merges). The executor semantics for interface amendments 11-13, built by a sol lane against the red acceptance tests B6, C5, D6 and flipped with tools/graph_acceptance_flip.py.

• B6 entrants: an EXPAND node with entrants=True accepts null lineage; entrant rows are built from the kernel's materialized columns (every carried column required, dtype-checked), memberships must name incumbent or entrant groups, the lineage receipt records [new_id, null], and cached replay restores the null. Entrant persons remain fail-closed because the frozen KernelResult has no channel for a new person's mandatory stratum; amendment 14 (KernelResult.strata, charter row B7) follows on Interface amendments 11-13: entrants, mass partition, declared tolerance #847 and a further flip lands here.
• C5 tolerance: recorded in every receipt, resolved for every declared input into KernelContext.tolerances (a rewrite reads its incumbent's owner), bound into the producer's key so a changed tolerance invalidates readers, carried through manifest save/load, shown in view/explain.
• D6 partitioned mass: accounted per (partition, stratum) when Graph.mass_partition is set; conserve enforced per partition and the rejection names the partition value; receipt carries a nested partition block beside the flat fields; kernel-declared accounting validated to the same shape.
• fit.qrf@1 measured: the H1 fixture regenerated on arm64 and on x86_64 under Rosetta differs by zero cells (max ULP 0), so the declared bound is Tolerance(ulps=1), recorded in the constant's comment; only pins.json moved.

Lane verification (verbatim in the lane report): graph suite 207 passed in 573.09s, cross-package kernels and country graph tests 29 passed, H1-H3 3 passed, ruff, ci_test_groups --verify, graph_acceptance_burndown --verify --baseline origin/main total 0. An independent rerun is in progress here and a sol review follows before merge.

🤖 Generated with Claude Code

[MaxGhenis]

Sol review (read-only pass over d048b68, full text in the lane report) plus my rulings as the graph owner. Changes requested; a fix lane follows once the B7 leg lands, so the two do not collide in population.py/executor.py.

Must fix before merge

1. EXPAND overlays can overwrite validated entity ids. _expand_cells accepts an entity's id column as an overlay coordinate; a kernel can then replace lineage-derived ids after validation, the receipt says one thing and the frame another, and warm replay rejects what cold execution accepted. Fix: refuse any expand_cells coordinate equal to its entity's id column (memberships stay legal), and after all overlays assert the final id index equals target_ids[entity].
2. B6 entrants and D6 partitions cannot compose. Entrant validation demands a downstream materialized_expand_outputs claimant for every carried column, the partition column included, while _apply_result rejects every ordinary owner of the partition coordinate. Ruling: an EXPAND-materialized partition value is structural. The overlay supplies it, it needs no downstream claimant, and ordinary nodes still cannot own the partition coordinate. Add the composed test (entrant with a partition).
3. The node key carries tolerance but not the rest of the kernel contract. QRF_PARAM_KERNEL and QRF_EXECUTOR_KERNEL share ref, implementation hash, and tolerance and differ only in seed_source, so a PARAM-produced artifact can hit under the EXECUTOR instance. Ruling: the key takes a canonical projection of the whole Capabilities (every field), not tolerance alone; a cache load also compares the stored capabilities as defense in depth. Tolerance does not go into implementation_hash, whose frozen meaning is source bytes plus dependency versions. Add a shared-store PARAM-then-EXECUTOR regression test.
4. Implicit rewrite incumbents are missing from KernelContext.tolerances. _project_context projects a rewrite incumbent even when it is not in Node.inputs; resolve tolerances over the union of explicit inputs and rewrite outputs, incumbents against input_version as the compiler and keys do.
5. Capabilities accepted look-alikes. Fixed on the interface side in Interface amendments 11-13: entrants, mass partition, declared tolerance #847 (head after 602c0f8): every field is validated at construction and KernelRegistry.register requires a genuine Capabilities instance. Merge Interface amendments 11-13: entrants, mass partition, declared tolerance #847's head into the fix branch.
6. A row-masked claimant can satisfy the entrant materialization bridge. The bridge checks coordinate, non-rewrite status, dtype, but not Owned.rows; require ROWS_ALL for bridge claims (or prove every entrant id sits inside the mask) and add the negative test.
7. RunManifest.population() mutates a returned frame's __class__ to add entity-name accessors. Ruling: no class mutation. population() returns one type; if entity attribute access is wanted it is a documented API, not a shim.

Follow-ups (same lane if cheap)

• Reword the fit.qrf@1 tolerance comment: a provisional one-ULP acceptance budget measured on one 12-output fixture (arm64 versus x86_64 under Rosetta, bit-identical), not an established forest-wide bound. Re-pin the implementation hash afterwards.
• An unpartitioned graph silently accepts a bogus receipt["mass"]["partition"] block; reject it when mass_partition is unset.
• Normalize -0.0 to 0.0 in rtol/atol before keying.
• Person entrants: amendment 14 (KernelResult.strata, charter B7) is on Interface amendments 11-13: entrants, mass partition, declared tolerance #847; the B7 leg is in flight and lands here.
• Regression coverage: the PR removes three markers and adjusts counts but adds no defensive tests; each finding above lands with its own unit test (test_graph_population.py, test_graph_executor.py, test_graph_keys.py).

Verified by the review under a read-only sandbox: focused population/declaration/kernel/key tests 52 passed; kernel and country graph tests 29 passed; ruff clean; ci_test_groups --verify ok; burndown total 0 against origin/main. My own rerun in the lane's worktree: graph suite 207 passed, cross-package 29 passed.

🤖 Generated with Claude Code

[MaxGhenis]

All seven rulings from the review are implemented at 7a8ecbe with a regression test each (details in the fix-lane report; squashed onto this branch after independent verification: 262 tests, ruff, burndown clean). The B7 leg (amendment 14, entrant person strata) landed in the previous commit. CI is the remaining gate.