Fail closed on relocated floating-literal value mismatches

[N0zoM1z0]

Problem

Canonical function-byte comparison rewrites COFF DIR32 fields to their allowlisted target addresses. Address equality alone is not enough for floating constants: a source object can reference a differently valued __real@... symbol and still receive the target address during replay. TH08 exposed this with source 0.0 mapped to target 128.0; the instruction bytes compared exact while gameplay semantics were wrong.

TH105 already validates ordinary literal allowlist bytes, but source __real@... identity can still be skipped when an override resolves to an address-validated symbol. Repository-wide tracking also does not independently decode every VC8 real-literal symbol.

Required fix

• Decode VC8 32-bit and 64-bit __real@... symbols into little-endian IEEE bytes.
• During COFF comparison, require every actual real-literal DIR32 relocation to use zero addend and match the resolved target bytes, regardless of allowlist validation mode.
• During manifest/tracking validation, audit real-literal relocation-ledger rows and explicit dir32_targets overrides.
• Add positive and negative contract tests, including the 0.0 versus 128.0 regression.
• Run the static audit from python3 scripts/ci.py.
• Make a successful final local python3 scripts/ci.py run an explicit agent pre-commit/pre-push requirement; GitHub Actions is not a substitute.

Acceptance

The complete current TH105 literal ledger and configured mappings pass; deliberately mismatched symbols, addends, ledger bytes, or target bytes fail closed with structured diagnostics. Documentation records the failure mode and reusable workflow.