ADC-682: bind qualified native flux provider slots

[wolf75222]

Stack

This draft is intentionally stacked on #641 (codex/adc682-qualified-flux-pack-20260730). It addresses one confirmed ADC-682 gap without overlapping ADC-683, ADC-684, or ADC-685.

What changed

• authenticate the generated flux_provider_requirements at compile time before constructing a device provider pack;
• reject incomplete, unavailable, unqualified, duplicate-slot, or out-of-range generated rows;
• bind only the storage slots declared by the generated qualified pack instead of scanning the complete auxiliary width;
• keep device code dependent only on compile-time integer slots, not the host metadata rows containing strings;
• retain the legacy full-width route only for hand-written C++ fixture models that do not expose the generated ABI.

Why

#641 made the canonical qualified provider pack available to code generation, but native binding still ignored it and read every n_aux slot. The emitted contract was therefore inspection evidence rather than an enforced native ABI.

Validation

• 31 passed across the flux-interface architecture, compiler-provider, and provider-pack suites;
• Ruff passed on changed Python tests;
• clang-format dry-run passed on changed C++ files;
• docs/check_docs.py passed with one pre-existing stale-dependency warning;
• git diff --check passed.

No native build/install or shared build tree was used for this source-only stacked slice.

Deliberate non-claims / remaining ADC-682 work

• PhysicalFluxView still reconstructs the legacy sealed Aux representation internally;
• same-model/different-block provider identity is not yet proven end to end in the native ABI;
• duplicate native slots fail closed here rather than supplying distinct logical storage identities;
• CPU/GPU and Uniform/AMR logical-signature parity still needs the native acceptance matrix.