…EVEL discharge (task #149)

MODEL-2 (albor 370M Sovereign) gate #4 at PARTIAL: binds
AC-SHIP2-007 ("apr run produces syntactically valid Python on 100
held-out prompts") to FALSIFY-SHIP-017 via new GATE-ARCH-370M-005
with `discharge_status: PARTIAL_ALGORITHM_LEVEL`.

The decision rule — "≤ 1 SyntaxError tolerated out of 100, ≥ 2 is
a ship-blocker" — is a pure integer threshold and is proven correct
at `cargo test` time today. Full discharge (100-prompt `apr run`
harness against a trained 370M .apr) remains PENDING on pretraining
compute-dispatch (AC-SHIP2-003/004) — fixture swap is data-only, no
harness rewrite required.

Changes:
- crates/aprender-train/src/models/llama_370m.rs:
  - Adds `AC_SHIP2_007_HELDOUT_PROMPT_COUNT` (=100) +
    `AC_SHIP2_007_MAX_TOLERATED_SYNTAX_ERRORS` (=1) consts mirroring
    the spec §6 harness size and §8.3 FALSIFY-SHIP-017 tolerance.
  - Adds `verdict_from_syntax_error_count(errors) -> Ship017Verdict`
    const fn — the pure threshold.
  - Adds `falsify_ship_017_syntax_error_count_threshold_logic` —
    Pass boundary (0,1), Fail boundary (2,50,100), monotonicity
    sweep ∈ [0,100], and provenance pinning.
  - Adds `falsify_ship_017_gate_arch_370m_005_has_partial_discharge_marker`
    — binds sovereign contract YAML shape (falsification_id,
    binds_to, discharge_status, evidence_discharged_by,
    full_discharge_blocks_on, ship_blocking) to Rust tests via
    include_str!.
- contracts/model-families/llama-370m-sovereign-v1.yaml v1.5.0 →
  v1.6.0 (stays ACTIVE): adds GATE-ARCH-370M-005.
- docs/specifications/aprender-train/ship-two-models-spec.md v2.23.0
  → v2.25.0 with amendment block: counter-example survey continues
  to find new PARTIAL levers after two prior "exhausted" verdicts
  (SHIP-015 → SHIP-019 → SHIP-017). New status: 3/12 ACTIVE + 4/12
  PARTIAL = 7/12 touched (58.3%).

Verification:
- cargo test -p aprender-train --lib llama_370m → 12/12 pass
  (including both new falsify_ship_017_* tests)
- cargo clippy -p aprender-train --lib -- -D warnings → clean
- pv validate contracts/model-families/llama-370m-sovereign-v1.yaml
  → Contract is valid

Closes task #149.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Binds AC-SHIP2-010 (inference decode throughput ≥ 100 tok/s on RTX
4090) to a new GATE-ARCH-370M-006 in the sovereign contract via a pure
f32 threshold fn + two unit tests. The compute-heavy half (`apr bench`
on a real trained 370M .apr) is deferred to AC-SHIP2-003/004
compute-dispatch; the decision rule itself is proven today.

Changes:
- crates/aprender-train/src/models/llama_370m.rs:
  * AC_SHIP2_010_MIN_DECODE_TPS_RTX4090 = 100.0 (const floor)
  * Ship020Verdict { Pass, Fail }
  * verdict_from_decode_tps(f32) -> Ship020Verdict (fn, non-finite → Fail)
  * falsify_ship_020_decode_tps_threshold_logic (5 invariants:
    Pass boundary, Fail boundary at one f32 ULP, monotonicity in
    both directions, conservative Fail for NaN/±∞, provenance
    pinning that the const stays = 100.0)
  * falsify_ship_020_gate_arch_370m_006_has_partial_discharge_marker
    (contract parses + advertises PARTIAL_ALGORITHM_LEVEL +
    evidence_discharged_by populated + full_discharge_blocks_on
    documented + ship_blocking:true)

- contracts/model-families/llama-370m-sovereign-v1.yaml:
  * v1.5.0 → v1.6.0, stays ACTIVE
  * New GATE-ARCH-370M-006 binding AC-SHIP2-010 ↔ FALSIFY-SHIP-020
    with discharge_status: PARTIAL_ALGORITHM_LEVEL

- docs/specifications/aprender-train/ship-two-models-spec.md:
  * v2.23.0 → v2.26.0 with amendment block
  * MODEL-2 ship-gate status updated: 3/12 ACTIVE + 5/12 PARTIAL =
    8/12 touched (66.7%)

- crates/aprender-train/src/train/device.rs:
  * 2 pre-existing fmt fixes (6 lines of whitespace) — restores
    `cargo fmt -p aprender-train --check` green. Pre-existing on
    origin/main; kept in this PR under Toyota Way "all defects are
    your defects" rule.

Pattern lesson: v2.22.0 declared MODEL-2 non-compute PARTIAL levers
"exhausted" — re-running the counter-example survey has now falsified
that verdict three times (SHIP-019 → SHIP-017 → SHIP-020). When a
SHIP gate names a threshold / tolerance / ratio / cut-off and the
compute-heavy harness is separable from the decision function, the
threshold fn can land today at unit-test time — even when the full
end-to-end harness is blocked on compute.

Full discharge blocks on: real 370M .apr from AC-SHIP2-003/004
compute-dispatch + three independent `apr bench --tokens 128 --json`
medians on RTX 4090 host. Fixture-swap only — no decision-rule rewrite.

Verification:
- cargo test -p aprender-train --lib models::llama_370m → 11/11 PASS
- pv validate contracts/model-families/llama-370m-sovereign-v1.yaml
  → "Contract is valid. 0 error(s), 0 warning(s)."
- cargo clippy -p aprender-train --lib → green
- cargo fmt -p aprender-train --check → green

Task #150.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>