Add bounded requirement source codec selection

[iperev]

Summary

• add a private bounded grouped-JSON requirement-source v2 codec with strict structural admission, canonical formatting, immutable source maps, and nondisclosing diagnostics
• freeze and byte-bind the V3 codec screen, exact candidate/metric decision projection, grammar-owner inventory, field/limit manifests, and causal mutant evidence
• register REQ-PROOFKIT-SPEC-025, its scenarios and bindings, and version the package as 0.5.1

Proof

• npx --yes npm@11.18.0 run check
• go test -race ./internal/kernel/requirementsourcecodec ./internal/kernel/requirementsourcemodel -count=1
• go test ./internal/kernel/requirementsourcecodec -run "^$" -fuzz "^FuzzParseCanonicalRoundTrip$" -fuzztime=20s
• exact closeout: 84/84 requirements, 252 scenarios, 80 commands, 93 browser tests
• independent closeout reviews exercised decision projection, metric authority, gzip member closure, grammar ownership, and the six-coordinate metric mutation basis

Non-claims

• current requirement sources are not migrated or rewritten
• no public source extension or CLI command is introduced
• the frozen screen does not prove corpus-external optimality or open-world absence of equivalent parsers
• this PR does not publish packages, deploy, approve rollout, or establish production readiness