v0.7.0: no-replay TPE continuation, portable checkpoints, exact bounded threading

[luisleo526]

Release 0.7.0

This is a breaking minor release, not 0.6.1. Legacy row-only TPE continuation
rebuilds deterministically without historical proposals. Matching saved sampler
checkpoints retain exact continuation. Grid/random behavior is unchanged.

Independent-review fixes

• P1-1: Canonical PFHTPE2 checkpoints serialize each MT19937-64 engine as
  312 explicit uint64 words and a position, independent of standard-library stream
  formats. Compiler/stdlib/target/floating-point build identity is enforced;
  incompatible builds rebuild rather than exit 4. Both CI platforms verify the
  checked-in two-engine golden and its future-word hash.
• P1-2 / P2-3: Version, changelog and docs are 0.7.0. Fresh-run ordering stays
  replay_contract: ordered_batches_v1; TPE continuation has its own
  continuation_contract: sampler_checkpoint_v2. Breaking changes quote the old
  promises and document the new enum, C++ interface, concurrent const source reads,
  row-only/JSONL limitation, old-reader rejection and internal threads.
• P2-1: Reservoir-seven checkpoint cases (201 parent + 300 new, batches 1/5/8)
  kill both actual mutants: one extra reservoir draw and skipped RNG restoration.
• P2-2: Explicit one-versus-eight-worker tests cover 4,200 mixed/log rows and
  4,096 rows × 32 inputs; independent unmodified-v0.6.0 serial hashes are pinned.
• P3-1 / P3-2: History identity is checked before checkpoint observation lists;
  shorter histories rebuild. Only compact cached model lists are serialized, so
  stale full-history lists cannot inflate switch-transition checkpoints.
• P3-3: Persistent workers are reused across EI attempts, fall back to serial on
  resource failure, and honor affinity plus Linux cgroup v1/v2 quotas. C++/work.json
  max_threads / native --tpe-max-threads never change proposal bits.
• P3-4: All-zero/degenerate MT states are rejected. Checksums provide integrity,
  not authenticity; warm files are trusted input.

Exactness and validation

GCC/libstdc++ and Apple-clang/libc++ restore the same canonical engine golden.
Full sampler exchanges in both directions rebuild with exit zero because their
numerical builds differ; same-build checkpoints restore. Actual v0.5.0 and v0.6.0
runner oracles each pass 91 cases, including bounded reservoir-seven checkpoints.

Benchmark protocol, old censored replay boundaries, reviewed timing tables and
gate evidence are documented in benchmarks/noreplay/README.md.

AWS 8-vCPU / 8-GiB gates: Release, ASan/UBSan and TSan each pass 31/31 CTests;
Python passes 70/70; the real-strategy E2E passes 12 continuation cases plus the
canonical seven-trade/four-metric comparison. Ruff 0.15.20 check and format check
pass; Doxygen has zero warnings and validates 247 HTML files. The pinned Optuna
smoke CSV and metadata sidecar are retained with verified hashes.

All six refreshed full-history batch hashes match the v0.6.0 serial baseline.
500k × 32 takes 69.167101 seconds before / 16.534632 after (4.18x), and 2M × 32
takes 287.644111 / 70.008436 (4.11x), for eight cold-cache proposals including
acquisition. Bounded switch-1000 remains a different estimator and an owner
decision; no estimator default changes. These are sampler-only diagnostics, not
Cloud Run timings or an SLA.

No engine/codegen gitlink changes. Do not merge or tag this PR.