Enforce strict current validation before Managed publication

[pcvantol]

Summary

• persist one immutable candidate- and repair-ordinal-bound validation profile identity
• require exact terminal PASS receipts for every profile-owned required control before Managed publication
• keep Quality and Security separate and unable to compensate for failed or missing local validation
• run the canonical Engineering Platform validation workflow on Python 3.14
• advance the collision-safe source identity from 2.3.2 to 2.3.4; 2.3.3 remains reserved by parked draft PR Draft: managed post-assurance publication closure #175

Qualification

• Python 3.14.7 full source suite: 1548 tests PASS
• Python 3.14.7 installed-wheel suite: 1548 tests PASS
• installed P-TRANSPORT 3x2 ingress matrix PASS
• deterministic Genesis, Managed and controlled-recovery E2E PASS
• HTTP JSON, OpenAPI and Postman contract PASS
• coverage contract PASS: 84.66% aggregate; execution_host.py 80.66%
• product wheel and sdist build PASS
• production wheel qualification PASS
• version consistency PASS for 15 projections
• git diff check PASS

Scope

No canary, submission, configuration, governance, installer, release, or primary CENTRAL mutation was performed. PR #175 remains untouched, open, draft, and parked-not-qualified.