MP2-045: bind package version coordinates

[Miko997]

Outcome

Problem

MP2-045 / MET-100 requires every adapter wheel and the source SDK to have one fail-closed version coordinate in the existing release-set authority, while the older adapter audit baseline must remain historical rather than current authority.

User-visible behavior

None. Package versions remain unchanged; validation rejects inconsistent version metadata.

Changes

Scope

Adds exact per-project version coordinates to the release-set registry and validates each adapter/SDK version across its pyproject, editable uv.lock entry, and cross-adapter registry. Records the existing audited base as historical with current_release_set_authority=false. Includes schema, negative tests, and mechanically regenerated currentness records. The ManiSkill lock also moves urllib3 2.7.0 to 2.8.0 after exact-head supply-chain qualification identified three newly disclosed vulnerabilities. No workflow, publication, protection, package-version, or unrelated dependency change.

Compatibility

Python/platform support, package names, wheel versions, CLI/API behavior, and historical evidence remain unchanged. Existing release-set consumers retain schema v1 and receive additive required coordinates. The indirect urllib3 correction stays inside the governed ManiSkill Python 3.12 profile.

Evidence and research impact

Validation is stricter and fail-closed. Negative coverage rejects missing, unknown, wrong-but-valid, pyproject-drifted, lock-drifted, registry-drifted, root-authority-drifted, and historical-authority-confused coordinates. Historical audit bytes are not rewritten.

Validation

Tests

• Local: release/package tests; adapter registry; five adapter/SDK lock checks; canonical collection; Ruff; format; mypy; public/functional/trace currentness; diff check.
• Security correction: Python 3.12 ManiSkill export audited with OSV after the lock update: no known vulnerabilities. The failing exact-head CodeQL run 36747528397 is retained as defect evidence for CVE-2026-97687, CVE-2026-97688, and CVE-2026-97689.
• Hosted qualification: required afresh for the final exact head after the security-lock correction. The earlier collection-contract failure 36725163320 and the failed security run are not classified as transient or reused as PASS.
• Independent review approved the original implementation, the collection-contract correction, the identical-tree source-identity renewal after a provider-ambiguous merge, and staged security/currentness tree e6e65dea9f404917fddc78ad94df8b861c975a33.

Documentation

Updated the canonical release-set registry, schema, test-count policy, and mechanically generated requirement/capability/functional/public-surface currentness records.

Boundaries

Privacy and security

No credentials, private data, recordings, archives, or external input were added. Paths remain repository-relative and validators parse metadata read-only.

Checklist

• The pull request is focused and its diff has been reviewed.
• New or changed behavior has tests, including a relevant failure path.
• Focused checks pass locally; required complete qualification must be green for the exact candidate before merge.
• User-facing commands, support boundaries, and documentation remain truthful.
• Third-party material has compatible licensing and required attribution.
• No credentials, private recordings, personal data, or identifying workcell data were added.
• Frozen v0.2.0 evidence, checksums, measurements, tag, and DOI metadata were not rewritten.
• Current package capabilities are not attributed to the v0.2.0 SoftwareX evidence or the TIM v0.1.3 measurements.