Harden DFT and NPT capability contracts

[benjipeng]

Summary

• Fail closed when fixed-cell DFT geometry optimization receives unsupported variable-cell modes, and remove inert cell/stress configuration knobs.
• Separate proof-level Monte Carlo NPT runtime support from GPCRmd workload-certification gaps without weakening production readiness.
• Route NVT and NPT proof requests through one shared MD protocol gate while preserving the previous GPCRmd compatibility entry point.
• Allow project-defined NPT transfer protocols without rewriting prepared source metadata, and bind their raw, resolved, and effective identities to trajectories and checkpoints.
• Reject resumed transfer runs when their protocol identity changes.
• Retain the measured periodic DFT PBE, force-materialization, timing, and repeated-band-point improvements.
• Record repository evidence ordering and parallel-worktree ownership rules.

Why

The public configuration, readiness metadata, and canonical documentation had drifted from the implemented runtime. Variable-cell DFT settings were accepted but unused, GPCRmd classified all NPT requests as unsupported physics even though a proof-level runtime exists, and transfer tests could only obtain NPT behavior by mutating source protocol metadata. Checkpoints also lacked an explicit binding to the source-versus-validation protocol decision.

User impact

Unsupported DFT relaxation requests now fail immediately with a precise error. GPCRmd reports distinguish implementation support from missing workload certification while production readiness remains fail closed. NVT and NPT callers receive an explicit runtime entry point. Project-defined NPT validation keeps source metadata immutable and preserves the exact protocol identity across restart.

Validation

• Targeted protocol, NPT, checkpoint/restart, and end-to-end CPU tests passed.
• ruff check src passed.
• API generation produced 59 pages.
• Narrative synchronization produced 34 pages.
• git diff --check passed.

The complete local suite cannot collect in the current headless macOS sandbox because an unchanged import-time test initializes MLX Metal. Linux mlx-cpu CI remains the routine full correctness reference.