research(eeg): add hardened synthetic late-fusion contract

[aurascoper]

Summary

• register EXP-NC-EEG-FUSION-001 as a deterministic, synthetic-only D0 late-fusion contract;
• preserve independent EEGNet and EEGPT outputs and allow only fixed F2 probability averaging at D0;
• add closed fused-state, replay, provenance, and bounded Qwen shadow-I/O validation;
• harden the contract after adversarial review with strict JSON parsing, recursive nested-field rejection, exact Qwen and F0-F6 registries, mandatory synthetic disposition, and checkpoint-bound encoder identities.

Commits

After rebasing onto the corrected base:

• f2d79dc research(eeg): add synthetic late-fusion contract (originally cab46a9)
• d6d74cb fix(eeg): harden synthetic fusion validation and provenance (originally d56b051)

Evidence boundary

This PR does not read physical EEG or private dialogue, execute EEGNet, EEGPT, BENDR, Qwen, or Gemma experiments, train a model, change acquisition or preprocessing, alter M0-M4 or experiment budgets, modify Swift runtime behavior, or authorize promotion.

fusion_scope_checks: passed
fusion_adversarial_findings: resolved
repository_wide_ruff: passed
pre_existing_ruff_fix_pr: 28
pre_existing_ruff_fix_merged: true
introduced_by_fusion_pr: false
merge_status: ready_for_review

Pre-existing Ruff proof

Before the cleanup, ruff check NeuralComposeEEG produced the identical F841 at NeuralComposeEEG/src/neuralcompose_eeg/jepa_synthetic.py:1149 on both base 788aa6 and fusion head d56b051. Scoped Ruff over every Python file modified by this PR passed. The one-line dead-assignment removal was isolated in PR #28, passed CI, and was merged into research/eeg-fusion-base; this branch was then rebased onto that corrected base.

Validation after rebase

• ruff check NeuralComposeEEG -> passed;
• scoped Ruff over the modified Python files -> passed;
• PYTHONPATH=NeuralComposeEEG/src pytest -q NeuralComposeEEG/tests/test_fusion_contract.py -> 22 passed, 25 subtests passed;
• PYTHONPATH=NeuralComposeEEG/src pytest -q NeuralComposeEEG/tests -> 88 passed, 25 subtests passed;
• Python compilation -> passed;
• Draft 2020-12 validation -> all six canonical fused states passed;
• swapped/missing checkpoint identity attacks -> rejected;
• 11 recursive, non-finite, non-numeric, out-of-range, and malformed Qwen input attacks -> rejected;
• mutable task, action, reason-code, and F0-F6 registry attacks -> rejected;
• replay tampering and disposition changes -> rejected;
• synthetic-to-physical source-manifest admission -> rejected;
• two independent artifact regenerations -> byte-identical to each other and the committed bundle;
• artifact privacy/disposition scan, 29 internal links, and cumulative git diff --check -> passed;
• GitHub build-and-test -> passed in 4m29s.

Readiness

The cumulative adversarial review has zero blocking or high findings, every publication gate is green, and this PR is ready for human review. It remains unmerged; no runtime, promotion, or physical-data authorization follows from review readiness.