feat: add Runner v1.1.0 and Ca1p5e4 R2 production protocol

[Javis-101]

Summary

Supersedes the production protocol direction in #1 with the new RiverMind formal-production candidate while preserving all historical v1.0.1/R1F125 files for reproducibility.

This PR adds Runner v1.1.0, the new GW-Ca1p5e4-R2-v1 protocol, and fail-safe case-local numerical-failure isolation for NVIDIA MPS.

Frozen R2 protocol

Physical/domain settings:

• Ca = 1.5e-4
• rhoA = rhoB = 0.10
• tauA = 0.78, tauB = 0.92
• alpha = 0.009, beta = 0.90
• SCAL affinity 0.2588190451, nominal water contact angle 75°
• 128³ ROI + 3/3 reservoir layers, BC4, +Z
• production target remains MPS-8

Stopping rule:

check_pvi = 0.1
window_points = 5
max_pvi = 3.6

STANDARD
start_pvi   = 0.5
max_dsg     = 0.0030
range_sg    = 0.0060
max_flip    = 0.0100
consecutive = 4

ACCEPTED (unchanged)
start_pvi   = 3.0
max_dsg     = 0.008
range_sg    = 0.025
max_flip    = 0.030
consecutive = 3

Runner time-grid contract:

• CHECKPOINT_STEPS = 22124
• MAX_STEPS = 796464
• earliest all-pass STANDARD endpoint = 0.8 PVI

Changing Ca creates a new scientific protocol identity. Existing Ca=2e-4 production results are retained as historical evidence and must not be migrated into the new formal dataset.

Numerical-failure isolation

Runner v1.0.1 conservatively writes an epoch fault immediately after detecting an LBPM numerical failure, which can quarantine otherwise healthy MPS peers.

v1.1.0 changes only the containment decision:

1. a numerical failure first attempts targeted MPS v2 terminate_client for the uniquely identified current CUDA client;
2. only explicit safe_context_termination=true allows the case to remain a case-local NUMERICAL_FAILED without creating a shared epoch fault;
3. if the client already exited, cannot be uniquely identified, MPS refuses termination, or safety is otherwise unconfirmed, the existing epoch-wide fault/quarantine path remains unchanged;
4. numerical failures never publish a valid scientific result or completion marker.

No unsafe host signal is introduced; the existing MPS identity and safe-termination contract remains the gate.

TDD / validation evidence

The new contracts were introduced red-first:

• R2 protocol tests initially failed because the new protocol preset did not exist;
• safe-isolation integration test initially failed because the old worker still created the epoch fault.

Final branch CI at 68ce62ac3f0a1a21ddd676ed83883284d69ffc90:

• static publication gates: PASS;
• Python 3.9 engineering suite: PASS;
• Python 3.12 engineering suite: PASS;
• 66/66 tests PASS on Python 3.12;
• PACKAGE_CODE_FILES_VERIFIED=24;
• reproducible source-only ZIP build: PASS;
• extracted ZIP SHA256SUMS verification: PASS;
• extracted ZIP package verification: PASS;
• built ZIP: LBPM-Production-Runner-v1.1.0.zip;
• ZIP SHA256: 6b664605fbf82e0d7ad95ca5fe11293d0b9ace4ba5ad54e010adc3c05e424d40.

Relevant new regression tests include:

• safely contained numerical failure does not create an epoch fault, does not interrupt peers, and produces no scientific result;
• uncontainable/immediate numerical failure preserves the old peer-recovery path;
• MPS refusal never sends an unsafe host signal;
• R2 time-grid / earliest STANDARD / unchanged ACCEPTED / 3.6-PVI cap contracts.

Validation boundary / next gate

CI uses CPU fixtures and validates engineering contracts only. It does not certify real RTX 4090 D / NVIDIA MPS behavior or LBPM physics.

After review, the next gate is deployment into a new RiverMind Runner directory and a new output root, followed by a real-GPU Canary before MPS-8 formal production.

Suggested deployment identities:

• Runner: /root/rivermind-data/lbpm-runner-src-v1.1.0
• protocol: /root/rivermind-data/lbpm-production-protocols/GW-Ca1p5e4-R2-v1.toml
• output root: /root/rivermind-data/lbpm-production-data-ca1p5e4-r2-v1

This PR intentionally does not merge automatically and does not alter the immutable Bootstrap v1.0.3 release or the frozen upstream LBPM solver commit.