Certify selected k8 label instances in Lean

[petalas]

Summary

pinned k8 programs
  translate all 49,514 non-phase events
  kernel-check 97 blocks per orientation
  derive WellLabelled and final labels for both complete words

Add research/k8-lean-label-instance/, following Sagar Thakrar's PR1964 Python H1 audit and the PR1611/PR2748 event bindings. The new concrete Lean certificates include private COPY/CLEAR and all wrapper tags. Existing event semantics are reused.

Evidence

• Before: PR1964's complete extended-label instance was checked in Python; a concrete WellLabelled instance remained an open handoff.
• After: four Lean roots prove Stream.WellLabelled and final labRun labels for the translated forward/backward words. Fresh kernel reduction uses only the three retained axioms, with no native_decide; a false relabel theorem is rejected.
• Both 24,767-event emissions match the selected hashes. Ten actual-program semantic controls and ten focused tests pass, as do metadata/source checks, repository onboarding tests and Ruff. The saved formal receipt binds every input and generated module.
• The committed-byte preflight passes for all 27 package/input files, and a read-only Git export without Git passes the receipt replay and ten tests. The registered-package planner selects only this new package.
• Two read-only internal reviews checked translation and formal/generator completeness. The receipt snapshot issue they identified is fixed and covered by a regression test. Substantial AI assistance is disclosed in the package; no independent human review is claimed.

uv run --python 3.12 --no-project python -B scripts/research_package.py \
  --package research/k8-lean-label-instance

# With the existing Lean 4.21.0 / Mathlib v4.21.0 environment prepared:
uv run --python 3.12 --no-project python -B \
  research/k8-lean-label-instance/check_lean.py --lake-project formal/lean

Started from current main 9ee73fecdbae9f892a6496dbdfae872217cf4601, priority revision 5. The submission refresh at 95ff4e2dd396c505932a43ff7c1cdfdd94b8c867 has unchanged guidance and consumed inputs. The package records the live overlap coverage. The canonical investigation and claim retains predecessor credit and the remaining handoff.

This proves H1 for the translated fixed words. The Python/JSON adapter, exact operator recipes, scalar endpoints, hosting, all-size, precision/tape and supplier admission remain outside scope. No new kappa or complete selected cold replay is claimed.

Merge Danger

Door: two-way.

Blast Radius: package.

Only a new opt-in package is added. The default CI replay checks the source/generated-proof binding and Python controls; fresh Lean compilation is an explicit separate command. The selected frontier and frozen predecessors are unchanged.