v0.18.0 — portable aggregate evidence bundles

Quantfit 0.18.0 releases PR #121 individually: portable aggregate evidence bundles.

Released independently from PR #121: portable aggregate evidence bundles.

Original introduction notes follow; the linked completed source acceptance supersedes their historical pending-qualification wording.

• Offline bundle create/bundle verify preserve exact aggregate bytes, conditional
  flags, negative gate decisions and reportless pre-run refusals after relocation.
  Fixed role paths and same-buffer validators refuse raw payloads and substitutions;
  integrity never authenticates scientific or human-label claims. Synthetic functional
  records are in validation/2026-10-08-portable-evidence-bundles/; hosted qualification
  is pending.

The introduced source passed hosted acceptance; release publication separately qualifies the exact versioned distributions. Historical producer versions and run records remain unchanged. No QSR v1 freeze or new scientific GO is claimed.

Local validation: 1699 sparse local tests passed with 13 skipped, plus two separately available numerical properties; full Torch/model proof is hosted. Exact-head hosted CI passed before merging. The protected publishing workflow repeats full qualification and attests the exact distributions before PyPI publication.