fix(experiment): make run identity collision-safe - #20

What this fixes

Closes #19.

ExperimentRunner.run_single() decided whether a run had already completed from
an identifier built only from model alias, regime, condition and seed. Changing
the case count — or the resolved model, the distributions configuration, or a
provider parameter — produced the same identifier, so skip_completed=True
could treat a materially different experiment as already done and return None
without executing it.

10 cases   -> mock-R2-S0-seed42
1000 cases -> mock-R2-S0-seed42   # silently skipped

Approach

The readable label and machine identity are now separate:

Identity covers the case count, regime, condition, seed, a digest of the
resolved model ID, a digest of the parsed distributions configuration,
declared adapter/deployment identity, constructor-configured provider generation
parameters (top_p for the current OpenAI-compatible and Bedrock adapters), and
the package version. Per-call temperature and max_tokens are selected by
governance-regime code and covered by that package version. The distributions
fingerprint is semantic, so comments and formatting do not invalidate earlier
runs while changing a parameter does.

New standard-library-only module src/mech_gov/experiment/identity.py owns
canonicalization, digests, stored-record validation and safe diffs.
It never reads the environment, touches the filesystem, invokes a model, or
accepts raw provider configuration.

Failing open

Runs that cannot prove equivalence always execute rather than risk a wrong skip:
no stable non-empty model_id, undeclared or invalid provider identity,
ambiguous credentialed endpoint, unavailable package version, or unreadable
completion state. Malformed JSONL records, including integers rejected by
Python's conversion-size limit, are ignored rather than aborting the run.
Provider identity hook failures are isolated from experiment execution. A
sentinel never makes two unknown configurations compare equal.
Recomputing a run costs time; wrongly skipping one silently corrupts a result
set.

Backward compatibility

• Legacy records carrying only run_id are read, never rewritten or
  deleted, and never treated as equivalent to a versioned identity — a
  matching label logs MGI001 and the run executes.
• Result model_id, the manifest, both JSONL output paths, and the
  on_run_complete callback are unchanged.
• run_id and CLI display retain the legacy readable value. New machine
  identity is additive and never parsed from run_id.
• LLMInterface.resume_identity_parameters() is a concrete method returning
  None, so existing custom providers keep working; they are simply treated as
  non-resumable.
• Unknown schemas, malformed digests and payload mismatches warn and execute.

Warnings use stable codes MGI001–MGI008 on the
mech_gov.experiment.identity logger, naming the fields that differ and using a
12-hex SHA-256 reference for correlation. They never print raw labels, paths, or
configuration values; MGI008 distinguishes unreadable completion state from
invalid stored identity.

OpenAI-compatible endpoint targets and Bedrock regions are represented only by
SHA-256 fingerprints. These are pseudonymous identifiers, not encryption.
SageMaker stays non-resumable because endpoint name plus region does not prove
which account-scoped deployment is selected. Existing raw model_id fields
remain unchanged for compatibility. The readable model alias also remains
public in run_id, run_label and identity; it must not contain credentials
or private identifiers.

Verification

• 307 tests pass on Python 3.10, 3.11, and 3.12 with 96% total coverage and
  100% coverage on experiment/identity.py.
• The pinned canonical byte/digest vector and ambient-decimal-context
  regression pass on all three supported interpreters.
• Ruff, Black, Mypy, the offline quickstart, governance CLI and package build
  pass.
• Dependency audit, dependency-license allowlist, SPDX headers, the upstream
  internal-pattern scan, changed-code Bandit comparison, tracked-tree secret
  scan and private-project/path scan pass.
• The built wheel installs and imports successfully.
• No dependency is added.

Windows was not executed; no platform-specific code is introduced.

Known provenance boundary: identity uses the package version. Source edits made
without a version change are outside the equivalence contract; editable-checkout
development should use skip_completed=False.

Questions for maintainers

1. Code provenance. Identity uses the package version. Git commit stays
   traceability-only in the existing code_version field, because
   _get_code_version() runs git rev-parse in the caller's working directory
   and therefore reports whatever repository the user happens to run from. Would
   you prefer a stricter contract, accepting that runs from a source checkout
   become non-resumable?
2. Provider parameters. Adding resume_identity_parameters() widens
   LLMInterface. If you would rather not, I can drop it and narrow the v1
   guarantee to RunConfig plus distributions and model identity, documenting
   the residual collision risk.
3. SageMaker identity. It is non-resumable by default because the current
   configuration lacks an account-scoped immutable deployment identifier. Would
   you prefer an explicit safe deployment-ID field in a later change?
4. Legacy compatibility mode. The selected safe default always reruns
   label-only legacy records because they cannot prove equivalence. Would you
   prefer a clearly named opt-in flag that restores label-based legacy resume
   while explicitly accepting collision risk?