feat: enforce plan-scoped sampling, GOS, delta, and adaptation

[zzylol]

Stacked on #476.

Adds the final physical-runtime policy layer on top of TransmissionPlan.

• binds typed sampling, delta, and CountSketch GOS policies to exact materialization fingerprints
• validates family/estimator/mode combinations and periodic full checkpoints
• scopes sequence/checkpoint lineage by plan, materialization, concrete series, producer and producer epoch; continuity crosses windows while each frame retains its own window identity
• authorizes telemetry-driven changes only as a staged next plan_version with exact fresh evidence and bounded guardrails
• enforces authorization at the atomic backend physical-plan endpoint
• uses one canonical concrete-series identity; grouped frames retain labels and ungrouped frames use
• preflights complete batch checkpoint/sequence lineage against a scratch snapshot before applying the first frame
• serializes physical frame batches, decodes payloads before committing lineage, then synchronously updates snapshot/store
• ignores exact retries, rejects gaps, and makes reads overlapping an incomplete window fail closed until exact-tier fallback
• treats HTTP 2xx / gRPC OK as the ACK; no custom checksum/ACK/WAL transport protocol. A restart forgets receiver lineage and safely requires a new full checkpoint.

Strict runtime contract follow-up (2026-09-03):

• modified-OTLP ingest now takes one ActivePhysicalPlan snapshot and derives both runtime materializations and the transmission contract from that same generation
• PrecomputePlan rejects empty or duplicate schema IDs, and TransmissionPlan rejects rule encodings not advertised by the bound schema
• every non-bootstrap active generation authorizes its successor, so changing plan_id cannot bypass runtime-adaptation guardrails
• TopK, window-cost, and runtime-adaptation evidence dated after the validation clock is rejected rather than treated as age zero

Validation after the latest update:

• control_plane physical compiler tests: 16 passed
• cargo check -p data_plane
• cargo fmt --all
• git diff --check

This PR is intentionally open and must follow #476.