Execute economy-transition-v6 and record its transition trace

[kaikisegfault]

Closes #153.

The version-six package encoded the contract and ran none of it. This adds the half that executes, and it comes before the C++ kernel for the reason M3.9b established: a codec never asks where a transaction gets its arguments, so two implementations agreed perfectly about a message neither could construct. The execution model is the first step that runs a transition.

What it adds

• simulation/economy_transition_v6/ledger.py — a version-six state and its conservation and structural invariants, every one an equality.
• execution.py — admission, escrow resolution under both authorization schemes, and the shared envelope checks.
• transitions.py and value_transitions.py — the fourteen kinds in their specified rejection orders. The settlement is imported from simulation/economy_transition_v3/, never copied.
• block.py — ordered block execution with the cycle-assignment prologue, the transaction root, the 146-byte header, the block ID, and block-level atomicity that restores the pre-block state on a rejection.
• trace.py — the recorded six-scenario fixture.
• test-vectors/economy-transition-v6-execution.txt — 512 normative vectors.
• tools/economy-transition-v6-execution-vectors/ — the verifier, whose expected.py imports nothing from simulation/.
• 51 tests across two modules, both registered in CMakeLists.txt.
• ADR 0045.

The four things it settles

Building it reached three places where the accepted contract admits two readings and one where it is silent. Each is consensus-visible; none is founder-reserved. ADR 0045 records each with its alternative.

1. DEBIT_OVERFLOW belongs at envelope check 8. The literal shared-envelope order leaves the balance comparison undefined on its own input and would make a frozen code unreachable that the specification does not list as unreachable.
2. An unrequested confirmation field is refused at execution with UNAUTHORIZED. The specification places the rule at admission, which cannot read the stored posture the predicate needs, and names MALFORMED_TRANSACTION, which the result-code space does not contain — admission codes and result codes are disjoint namespaces that share numbers. This is the one correction owed to a later contract version.
3. NOTHING_TO_MINT is the empty walk range. The literal equality lets a freshly activated seat's mint lower its own accumulation mark by two windows, which destroys the exactness argument the accumulation cap rests on.
4. The cycle assignment is a prologue, and that is a decision about money. Under the accepted reading a founder's mint at the window boundary collects 114,860,000,000 atomic; under the other it succeeds, collects zero, and advances the mark anyway, forfeiting the cycle permanently. A referral in the same block is only deferred. Both readings are run against identical inputs and both figures are recorded.

Evidence

• 512 vectors verified. Every value two sources can reach is derived twice — once by expected.py, once by a live run — and recorded only when both agree.
• Three inherited constructions are checked against a third source before anything rests on them: the ordered transaction tree and the accepted version-one signed transfer against test-vectors/protocol-primitives-v1.txt, and the block header and block ID against test-vectors/ledger-transition-v1.txt.
• The accepted 200-octet version-one transfer is admitted byte-for-byte on a chain stamped with the accepted chain ID, refused with RECIPIENT_NOT_REGISTERED, and then accepted with only the 32 recipient octets replaced. Byte identity preserved, execution identity not.
• Six mutation probes fail closed: a re-versioned block header (104 failures), the assignment moved after the transactions (33), an unrequested confirmation no longer refused (10), the literal NOTHING_TO_MINT equality (36), a changed escrow domain label (116), and a fixture that loses its last consecutive block pair (20).
• Two real defects were found during the slice. The tests caught admission codes being looked up in the result-code table — which the vectors could not, because the trace had no admission failure in it, so two are now in the fixture. And the sixth probe exists because this slice's own file held a vacuous claim: an all() over an empty set of consecutive block pairs.
• Nothing accepted was edited. All five predecessor vector files verify at 238, 579, 441, 550, and 462.

Verification

Full hosted matrix required (tools/verification_scope.py classifies this full). Locally: 6 v6 test modules OK, all six transition verifiers pass at their recorded counts, tools/verify_metadata.py validates 207 internal links, and the registration guard passes.