Fix policy enforcement, audit integrity and quantum result validation

[sylvesterkaczmarek]

Malformed policy values could enable remote or asynchronous execution: the string "false" became True, and fractional or non-finite resource counts escaped validation. Concurrent writers could also fork the audit chain, and concurrent Guards could change the simulator target and seed underneath another workload. The VQE example was labelled as molecular hydrogen despite implementing a finite-basis deuteron Hamiltonian.

This change:

• Validates policy and request types at construction, preserves valid defaults and rejects malformed resource estimates before execution.
• Serialises audit verification and durable appends across threads and processes, handles short/interrupted writes, and preserves damaged history while rejecting further appends.
• Checks existing audit integrity and append access before configuration, records application denials exactly once, and keeps ordinary numeric result mappings intact.
• Serialises cooperating Guard calls around target configuration, resource probing and callbacks, verifies the requested target became active, and avoids attributing active-platform metadata to every advertised target.
• Names the deuteron example accurately, records MeV units, rejects non-finite energies, and verifies actual CPU expectation values against an analytical curve and independently constructed Hamiltonian matrix.

Validation completed locally:

• 174 tests pass with CUDA-Q 0.15.1, including real qpp-cpu GHZ sampling and deuteron numerical checks.
• The same 174 tests pass against the installed wheel from outside the checkout; all 12 installed modules match the reviewed source.
• GHZ and VQE CLI workloads, the library integration example, and resulting audit chains pass.
• Source and wheel distributions build and pass twine check; a clean installation without CUDA-Q correctly reports the missing optional runtime.
• Thread and spawned-process audit regressions reproduce the broken chain on the original commit and pass with this fix.
• CI now covers base functionality on macOS and Windows as well as Linux Python 3.11–3.14, with a separate real CUDA-Q CPU mathematics job.

Compatibility and limits:

• Malformed values now raise ValueError rather than being coerced.
• Logs require newline-complete records and a persistent writable .lock sidecar. Read-only exports should be copied into a writable directory for verification.
• Guard callbacks are serialised within a process; nested guarded execution is rejected. Asynchronous callbacks must await completion to remain within the protected interval.
• Audit preflight cannot guarantee the final append after a later disk or process failure. Full-chain append verification remains O(N) per append.
• run vqe and the historical h2_vqe_problem function remain available; new audit workload names use deuteron-vqe-grid.
• No GPU or remote QPU execution was tested, and no package release is included.

Scientific reference: Dumitrescu et al., Cloud Quantum Computing of an Atomic Nucleus, Eq. (4). The reported grid minimum is for the rounded N=2 model, not an extrapolated physical binding energy.

GitHub CI passed on the reviewed head e78fd53: Linux Python 3.11–3.14, macOS/Windows Python 3.12, distribution build and installed-wheel checks, and real CUDA-Q CPU numerical/CLI workloads. Both push and pull-request runs completed successfully. Pull-request CI run.