Bind Python client qualification to exact assertions

[RobLe3]

Summary

• replace broad Python qualification bindings with one unique exact pytest node for the support case and each of 25 applicable risks
• bind executions to all matrix dimensions and immutable candidate/artifact/runtime/offline-environment digests
• add focused malformed/missing/permission-denied configuration, dispatch-ticket lifecycle, restricted-directory fail-closed, TLS failure and pre-1 release-boundary tests

Validation

• driver contract: 7/7 tests passed
• all 26 unique exact pytest nodes executed individually and passed
• uv lock --check
• Ruff passed for src, tests and scripts
• mypy baseline passed at the existing 74/74 no-regression boundary
• full suite: 1,222 passed, 2 skipped, 9 subtests passed
• JSON, Python compilation and diff checks passed

No Docker/VM lane or durable build target was created for this source-level change.

This advances exact source-level semantic binding for #119. It does not complete any runtime/OS/architecture/Directory/mode cell, packaged/offline environment, representative workflow, release, deployment, or 1.0/stability claim.