fix: Phase 4+5 review findings — dimension extraction, poll_progress deserialization

[rysweet]

Phase 4 Review Findings (PR #108)

MEDIUM

• python/simard_gym_bridge.py:89-103: _extract_dimensions only populates 3/5 dimensions (temporal_awareness and source_attribution always 0.0)
• python/simard_gym_bridge.py:249-252: _run_long_horizon uses max instead of average across categories, inflating scores
• python/simard_gym_bridge.py:178: scenario_id path traversal not sanitized

Phase 5 Review Findings (PR #107)

HIGH

• src/agent_goal_assignment.rs:181: Silent .ok() on deserialization in poll_progress — violates Pillar 11. Should propagate the error or return a distinct status.

LOW

• src/identity_composition.rs:79-84: max_subordinate_depth() reads env every call, no caching
• tests/composition.rs:25: Box::leak in test mock, use Arc instead
• Clamp SIMARD_MAX_SUBORDINATE_DEPTH to upper bound (e.g., 10)