Preserve rejected prefix diagnostics and isolate Git fixture signing

[CompleteDotTech]

Summary

• Preserve portable metrics for three rejected actual-weight prefix-gradient candidates; all acceptance and completion claims remain false.
• Record the actual budget-driven question geometry and corrected normalization-only replay. Module input hooks also include residual contributions; the superseded comparison is identified explicitly.
• Isolate the source-capture test fixture from machine-wide commit signing. Real repository commits retain verified SSH signatures.

Verification

• python -m pytest -q: 875 passed, 62 skipped (46.88 s).
• python -m compileall -q src tests scripts: passed.
• Preserved feature matrix verifier: passed.
• Portable receipt review: three terminal rejected candidates, finite metrics, no private local paths, all 33 production Python file hashes unchanged.
• Initial test failure was the temporary fixture inheriting an unresponsive WSL signing wrapper; the explicit fixture-only Git option resolves it. Publication uses the existing Windows key already registered for GitHub signing, without changing global configuration or restarting WSL.

Limits

No model code, existing acceptance flags, reference criteria, optimizer budgets, or deployment settings change. Operator/two-layer results do not qualify the full model. The branch-owned full-weight candidate compares fresh candidate modes with hash-verified preserved full-row/HF task gradients and still fails. No resume, BF16, predictive-quality, continuous-resource, or issue-completion claim is made.

Refs #3.