feat: add deterministic RNG checkpoints

[anantgar]

Summary

• Add atomic clean checkpoints for Shinka-owned random streams and async runner state.
• Add seeded strict, if_available, and reseed resume modes plus Ctrl-C/programmatic checkpoint requests.
• Bring randomized SQLite selection under the checkpointed Python RNG.

Why

A seed recreates the start of a random stream, but the previous resume path did not continue its exact position. Clean checkpoints let long campaigns stop and resume from a verified, drained boundary.

Testing

• uv run ruff check tests --exclude tests/file.py
• uv run mypy --follow-imports=skip --ignore-missing-imports tests/test_*.py tests/conftest.py
• uv run --with pytest-cov pytest -q tests -m "not requires_secrets" --cov=shinka --cov-report=term-missing --cov-report=xml:coverage.xml: 921 passed, 7 skipped, 1 deselected
• uv run --group docs mkdocs build --strict

Core evolution pipeline evidence

The local deterministic headless fixture ran with seed 20260830, one proposal/evaluation/DB worker, and two dynamically selected models. The baseline ran uninterrupted to 8 programs; the comparison checkpointed at 4 and strictly resumed to 8. The normalized generation trace matched exactly for parent, archive/top-k inspirations, island, model, code, score, and correctness, and the resume audit recorded deterministic_resume=true.

Reproduce with:

uv run pytest -q tests/test_headless_provider.py::test_seeded_checkpoint_resume_matches_uninterrupted_evolution

Risks and compatibility

• Existing runs keep best-effort resume by default; strict mode is opt-in.
• Checkpoints use pickle and must only be loaded from trusted result directories.
• The guarantee covers Shinka-owned randomness at a clean boundary, not external model responses or live in-flight work.

Docs and UI

Checkpoint configuration, CLI usage, resume modes, and guarantee boundaries are documented. No UI changes.