schema-2 sharded receipts: per-shard fingerprints + policy-gated carry-forward

[plancherb1]

What

• Schema "2" sharded receipts: --gpu-proof-shard NAME (+ optional --gpu-proof-shard-fingerprint-paths) emits a receipt whose shards block pins that shard's own narrow fingerprint and test membership by node id. Flat tests[] stays authoritative for outcomes; schema-1 receipts are byte-for-byte unchanged.
• gpu-proof merge unions schema-2 shards (unique names enforced), and gains --carry-from OLD: a shard absent from the fresh inputs is grafted iff (1) the old commit is an ancestor of the fresh one and (2) its narrow fingerprint recomputes identical at the current tree. Grafted shards are marked carried with full provenance — never silent.
• Verifier: for schema-2 receipts, every shard's narrow fingerprint is recomputed, shard membership must exactly partition tests[], and carried shards are rejected unless the policy sets allow_carried: true (bounded by carried_max_age_days, default 30) — that is the trust boundary, documented in security_model.md. A schema-1 receipt carrying a smuggled shards block is rejected.

Why

Big suites run GPU tests as many pytest invocations (crash isolation, sharding). With per-shard fingerprints, a merged receipt can honestly say: every test either ran at this commit, or ran at an ancestor on inputs that are provably byte-identical today — and CI can verify that claim instead of taking a local skip-list on faith.

Testing

• 11 new tests: emission (API + plugin flags), v2 merge + full verify, duplicate-shard refusal, shard-fingerprint drift (isolated from the global fingerprint), membership holes, carry happy-path with the policy gate exercised both ways, carry refusals (fingerprint drift, non-ancestor), stale-carried age windows both ways, schema-1 smuggling guard. Full suite 80 passed; mkdocs build --strict clean.
• End-to-end on GRiD's split-suite driver: fresh+carried merge with a real SSH key — verify fails rc=1 without the policy and passes fully with allow_carried: true.
• Backward compat: all 69 pre-existing tests untouched and green; v1 receipts verify byte-identically.