Exact-k ladder launcher + release plumbing: pool → k ∈ {N, 57,240, 20,000} datasets (#578 inc 3)

[MaxGhenis]

The pool (#583/#599/#600) needs release plumbing to become datasets. This adds the ladder launcher: given a post-agreement pool artifact and a release config, produce one exact-count dataset per run.

Flow per ladder point:

• Selection: k=N → identity support over the full pool (receipt emitted with design="full-pool"); k<N → select_exact_k (Exact-k selection: pi seam, certainty units + fixed-size Sampford draw, refit integration (#578 increment 3) #585 machinery: certainty units + true Sampford fixed-size πps, seed pinned in config, six-scalar receipt propagated verbatim into the release manifest).
• Refit: HT-with-q baseline from ORIGINAL frame weights per the Exact-k selection: pi seam, certainty units + fixed-size Sampford draw, refit integration (#578 increment 3) #585 contract (k=N refits from original weights directly), then the standard calibration path against the SAME frozen target register the incumbent used.
• Acceptance: strict-improvement gate vs the pinned incumbent on the frozen register (US base v2: one CPS+ACS+PUF-detail pool; datasets labeled by exact record count (dense = full pool; exact-k L0 selection) #578's acceptance rule) — a run that doesn't beat the incumbent fails with diagnostics.
• Release: exact-count release IDs (datasets labeled by realized record count), immutable publish receipt with --artifact-root --create-tag --no-latest semantics; pointer flips are never automatic.
• Provenance: release manifest binds the pool identity (release id + shas), selection receipt, refit diagnostics, and the pool build's agreement-gate verdict.

Structure: a manifest-bound pool loader, a calibration seam extending tools/build_us_fiscal_refresh_release.py (reused, not forked — batched PUF-tail invariant and failure diagnostics preserved), and tools/build_us_exact_k_ladder_release.py as the launcher. Config accepts exactly "N", 57240, or 20000 with explicit seed and frozen pool/ledger/incumbent pins; fail-closed on bad k, missing seed, k>N.

Fixture receipts (tiny pool): N→8 identity support; 57,240→6 and 20,000→4 via Sampford with normalized HT w/q refit.

Verification: full workspace 5,003 passed / 57 skipped / 0 failed (5,060 collected); #583 spine guard 495; pool input-surface guards 215; fiscal builder 166; ruff + changed-file format + git diff --check clean. Independently re-ran the launcher/e2e/io/spine-guard files from a fresh invocation before opening this PR. Disclosed: offline wheel build unavailable in the lane sandbox (hatchling uncached); wheel lane runs in CI.

Part of #578 increment 3. Real k=N/57,240/20,000 builds dispatch on Modal after this merges and run 6's pool lands.

🤖 Generated with Claude Code

[MaxGhenis]

Round-1 findings all addressed in e0e9924…0b3cc209 (6 commits): incumbent loaded/hashed/scored from one byte buffer with observed sha recorded (TOCTOU repro now fails); acceptance binds the incumbent's full loss basis — weighting version, family multipliers, cap, name-aligned loss-vector digest — with IncumbentLossBasisMismatchError on drift (both executed repros fail closed); exact-k forces --no-staging and receipts assert pointer_update=False for production AND staging; builder surface now enforces ratified k + explicit seed; ExactKRealizedCountMismatchError before any manifest write; legacy dense path restored to origin/main goldens (telemetry, three-key CLI, main() returns None) plus a full-main PUF-tail failure test; pool manifest hashed/parsed from one read authenticating publication_run_id; release docs updated. Full workspace 5,014 passed / 0 failed foreground.