H2C: enforce canonical status digest inverse invariants

[Pigbibi]

Scope

Fresh H2C from latest origin/main@294e30b8eed36f070299b1dc01d34955fb262918; PR #47 is closed/frozen evidence and was not reused.

This narrow pure canonical-bytes slice enforces structural inverse invariants:

• accepted feed count > 0 requires a non-empty row digest;
• aggregate accepted count > 0 requires a non-empty aggregate digest;
• zero-count and non-accepted cases require exact EMPTY_DIGEST;
• feeds must be non-empty, per-feed counts are bounded by MAX_ROWS_PER_FEED, top-level sums match, and rejected counts are zero;
• reader validates derivable structure only; it does not authenticate arbitrary non-empty digest values without row evidence.

No parser, I/O, workflow, publish, weekly, QAR, permission, or automation changes.

Validation

• focused pytest: 7 passed
• full pytest: 129 passed
• compileall: passed
• git diff --check: passed
• ruff: unavailable in environment

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR