gpu-proof merge: shard receipts, re-signed; tri-state config fix

[plancherb1]

What

• gpu-proof merge (new subcommand + merge.py): union N shard receipts from one commit into a single re-signed receipt. Large suites run GPU tests as several pytest invocations (per-module crash isolation, machine sharding); each emits its own receipt, and CI wants one artifact.
  • Refuses shards that disagree on anything a receipt pins: schema_version, repo.commit_sha, fingerprint, mode, or the environment the tests ran under. Duplicate node IDs across shards are a hard error (a sharding bug, never silently deduped).
  • repo.dirty is OR-ed; gpu_info survives CPU-only shards; per-shard provenance recorded under session.shards (additive — the verifier is unchanged, schema stays "1"; the merged receipt is re-signed locally and flows through gpu-proof verify as-is).
  • Trust model per docs/security_model.md: the merged receipt is an attestation by the merger; shard signatures are provenance, not re-verified (merge is offline).
• Config tri-state fix: explicit CLI values equal to their built-in defaults were silently ignored in favor of [tool.gpu_proof] (resolve() detected "set" by comparing against the default). Value-taking options now register a None sentinel; --gpu-proof-fail-on-skip ORs with toml since a store_true flag can only turn it on. Regression test included.
• Docs page docs/sharding.md (in nav), CHANGELOG, version 0.2.0.

Testing

• 8 new merge tests (happy-path merged receipt passes the full verifier with a mocked GitHub key fetch; refusal matrix for sha/fingerprint/env/dup-node-id; unsigned + dirty-OR + gpu_info survival) + 1 tri-state regression test. Full suite 69 passed; mkdocs build --strict clean.
• End-to-end on a real consumer (GRiD): per-module shard receipts from a split-suite driver → gpu-proof merge → gpu-proof verify passes all seven checks (real SSH key, live GitHub keys, real fingerprint + commit SHA).
• GLASS usage checked: it passes explicit --gpu-proof-out/--gpu-proof-fingerprint-paths values that differ from the built-in defaults, so the tri-state change is behavior-preserving there.