research: audit selected PR589 source blob binding

[1337isnot1337]

Summary

Adds a focused source-binding audit for the selected #1094 composition's PR589
bit supplier. The T16 assembler verifies its input record against the pinned
Git blob ID before parsing it. The source file at the PR head, the same record
at the merge path, and the selected T16 copy are byte-identical. A one-nibble,
still-valid 40-hex digest mutant is rejected by the production loader.

The package also binds the source record's loaded bit_lower to the selected
assembly field and checks the assembly's input SHA-256. The complete #1094
caller retains and compares the same T16 bit_supplier record.

This is a source-identity audit only. It does not validate the supplier's full
mathematical derivation, admit a supplier, run the full #1094 replay, or change
the selected kappa.

Scope and provenance

The task-card scatter/export example is separately covered by open PR #3801.
This package addresses one distinct source-binding field, BIT_BLOB. It keeps
PR #589, PR #555, the T16 controller lineage, and the selected assembly's
predecessor credit in the README.

Base: 20ecf2891d80b5acf18d980b2164fb44ea7faa90; priority revision 6.
Package commit: c68ba95d7b145490c005001af49301ac98f66b8b.

Validation

• Direct verifier on Python 3.14.8: pass, including positive and valid-digest
  negative fixtures.
• Package metadata and source pins: pass.
• Commit-byte check: pass for 19 package/input files.
• Selected research baseline: PASS_RESEARCH_BASELINE_BINDINGS_ONLY.
• Registered package replay was not started because this host lacks Python 3.12,
  the package runner's required interpreter. The full make frontier1094-verify
  replay was not run.

No PR was opened or pushed, in accordance with the session's external-scope
restriction.

Publication validation

python3.12 scripts/research_package.py --package research/selected-bit-source-binding-audit passed on CPython 3.12.3, and python3.12 scripts/check_research_commit.py --package research/selected-bit-source-binding-audit --check-source-history passed. The registered replay left the worktree clean. This supersedes any earlier pending note above for the registered package replay; separate full selected cold-replay limits remain as stated.