feat: add signed synthetic CPU ML foundation

[munisp]

Summary

• Adds deterministic synthetic-only multi-tenant Parquet Lakehouse data generation and signed manifests.
• Adds real CPU PyTorch MLP and PyTorch-Geometric GraphSAGE candidate training, artifact hashes, Ed25519 manifest verification and a fail-closed CPU inference service.
• Adds Ray remote-task candidate launcher, bounded candidate-cycle controller, authenticated tRPC proxy, opt-in worker registration and hardened non-production compose profile.

Validation

• python3 workers/python/ml_foundation/test_ml_foundation.py passes.
• python3 -m py_compile workers/python/ml_foundation/*.py passes.
• pnpm exec tsc --noEmit --pretty false passes.
• Verified one signed artifact bundle loads on CPU and returns human_review_required.

Safety boundary

This is synthetic-only candidate modeling. It does not connect to base-platform data or external systems and does not automate enforcement, payments, residency assertions, regulatory findings or adverse decisions. Production model/data governance remains a separate approval gate.