Packet 4: typed forecast provider boundary

[howdymary]

Summary

• add immutable forecast-safe requests and exact source/order-book provenance types
• add validated result, abstention, and provider-failure contracts with stable provider provenance
• implement market-baseline, bounded recalibration, and user callable adapters
• evaluate typed providers against paired market forecasts in deterministic v2 reports
• isolate opaque legacy model injection from maintained exports, registries, and genomes

Safety and integrity

• requests structurally exclude outcomes, resolutions, and fair probabilities
• stale/future timestamps, non-finite outputs, dynamic/mismatched provenance, and nested label injection fail closed
• provider configurations are strict JSON, deeply copied/frozen, and deterministically hashed
• no live, credential, network, or order path is enabled

Verification

• 347 tests pass
• compile, changed-file Black, scoped mypy, and diff checks pass
• deterministic baseline/recalibration CLI checks pass
• independent reviewer approved after adversarial structural-boundary review

Parent: #2
Closes #8
Depends on: #14

Stacked draft based on codex/packet-3-canonical-evaluation; retarget after prerequisites merge.