v0.2.2 — batch proof fields and audit certificates

Added

• Audit certificates: Explainer.certificate(x, result, target) turns any stored Counterfactual or Infeasible (the certified "no" included) into a strict-JSON-serializable audit record — a reproducibility record plus a fresh verification. It binds the claim to a model fingerprint, a constraint fingerprint, and the solve parameters, and re-verifies the returned plan (score, target membership, constraint check, plausibility, sampled region points) at issue time. It does not cryptographically prove that a search ran or that a proof="optimal" claim is true — re-running with the recorded seed/budgets on a fingerprint-matching model is how a validator checks that. Explainer.check_certificate(cert) recomputes both fingerprints against the current explainer, re-runs the verification block, and reports (model_match/constraints_match/verification_ok/mismatches) without ever raising on a mismatch. The new treecf.audit module exposes the underlying ir_fingerprint and constraints_fingerprint; a callable value_policy has no canonical encoding and marks the certificate "reproducible": false with a reason.
• BatchRecord.proof and BatchRecord.solver_stats: every batch record now carries the claim and (for exact solves) the diagnostics of the single-instance result that produced it. BatchResult.to_frame gains a proof column; save/load round-trip both fields, and files from earlier versions load with feasibility-based defaults.

Fixed

• The batch aggregate degraded-result warning pointed at "each result's own proof/solver_stats" while BatchRecord exposed neither field; the fields now exist, so the message is true as written.

Notes

• No solver behavior changes; no fixtures touched; no Rust source changes (only the mirrored version in rust/Cargo.toml/Cargo.lock).

See CHANGELOG.md for details.