R3a: проверять clean-set на финальном представлении - #476

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/labcolors-core/src/generic_boundary_tests.rs`:
- Around line 788-813: Update
clean_set_program_path_cannot_smuggle_auto_or_writer_contracts so it also
validates clean_set.rs, while stripping comments before checking forbidden
identifiers. Keep the guard focused on code identifiers rather than arbitrary
documentation text, preserving detection of actual writer/checkpoint and
quality-contract references.

In `@crates/labcolors-core/src/program_identity.rs`:
- Around line 774-843: Extract the duplicated constraint-body matching and
graph-binding logic into a shared helper that accepts the differing mode tag,
reusing the existing symbols such as constraint_color,
declared_srgb8_clean_set_constraint_color_for_release, and graph.add_edge.
Update both the hard and report_only loops to call this helper with their
respective mode tags, preserving all three constraint-body branches and edge
roles.

In `@crates/labcolors-core/src/program_mixed_evaluator_tests.rs`:
- Around line 602-608: Обновите ветку AssessmentV1::DeclaredSrgb8CleanSet в
тестовой пробе, чтобы checksum учитывал не только visible(), но также
violation() и rejected_blue_interval(). Смешайте их стабильные значения в probe
вместе с текущим RGB, чтобы differential-проверка выявляла изменения вида
нарушения и интервала.

In `@crates/labcolors-core/src/program_session.rs`:
- Around line 4068-4124: Consolidate the duplicated lookup and validation logic
in compile_constraints for DeclaredSrgb8CleanSet and
DeclaredSrgb8CleanSetFinalRecheckMutant by introducing and reusing a shared
helper such as compile_declared_clean_set_body. Pass the appropriate
package_pinned or final_recheck convention into the helper, preserving the
existing missing-target and absence_release validation behavior.

In `@scripts/test_verify_clean_set_receipt.py`:
- Around line 464-473: Расширьте
test_product_pin_rejects_noncanonical_name_or_digest отдельным кейсом для
невалидного digest: используйте корректное имя receipt-v1.json, но значение
digest с верхним регистром или некорректной длиной hex, чтобы выполнение дошло
до _sha256_string и verify_product_receipt завершился VerificationError.
Сохраните существующий кейс для невалидного имени файла.

In `@scripts/verify_clean_set_receipt.py`:
- Around line 429-437: Добавьте таймаут к вызову subprocess.check_output в Git
lookup и обработайте истечение таймаута через существующий catch, чтобы ошибка
преобразовывалась в VerificationError через _fail. Нормализуйте error.output
через значение по умолчанию, учитывающее None, перед decode, сохранив текущий
формат диагностического сообщения.
- Around line 837-855: Update the table-header parsing around current_table so
any TOML table header, including array-of-table forms such as [[bin]], [[test]],
and [[bench]], is recognized and resets the package context. Preserve matching
of ordinary sections like [package], and ensure subsequent fields from array
tables are not evaluated as package license fields.
- Around line 610-622: Replace the ternary expression in the accepted-points
validation near counts["accepted_chromatic"] and counts["neutral_points"] with
an explicit check: validate that both values are exact integers, then validate
their sum against ACCEPTED_POINTS using _exact_int. Preserve the existing
failure behavior for missing or non-integer values.
- Around line 356-372: Replace the hard-coded codec body offset in _decode_codec
with a value derived from the format constants, such as the header length plus
the offset-table size, and reuse that derived offset when slicing codec. Apply
the same change to the duplicated literal in _decode_raw, preserving the
existing validation and decoding behavior.