feat(observatory): add portable calculation profiles

docs/15_LABORATORY_RUN_CANON.md

@@ -278,11 +278,13 @@ an integrity or product need justifies a targeted migration.
 ## Observatory durable recorded queue and Worker dispatch
 
 Selecting a source and a laboratory setup in Observatory is not itself a run.
-The public submission contains only `source_session_id`, `setup_id` and an
-idempotency key. It cannot supply commands, executable text, filesystem paths,
-container images, model identities, resource limits or priority. The server
-resolves the allowlisted pair and seals all executable identity into one durable
-record:
+The exact legacy submission contains only `source_session_id`, `setup_id` and an
+idempotency key. A portable submission additionally returns the server-owned
+`definition_sha256` and one content-bound `check_sha256` obtained from preflight;
+both must be echoed unchanged during submit. Neither request can supply commands,
+executable text, filesystem paths, container images, model identities, resource
+limits or priority. The server resolves the allowlisted identities and seals all
+executable identity into one durable record:
 
 - the current source-catalog snapshot captured at admission, plus immutable source
   bundle and source-capability-manifest SHA-256 identities;
@@ -307,22 +309,33 @@ not an unknown model dependency. The binding pins the exact source pack rather
 than a volatile whole-catalog digest; the server captures and seals the current
 catalog snapshot into each admitted job.
 
-`LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39` now has a source-independent
-portable RunDefinition and lightweight recorded-source capability probe. The
-definition seals the exact model/component/resource identities, observation-only
-authority and generic `missioncore.recorded-eomt-ddrnet-review/v2` result
-contract; it contains no source Session id or label. Compatibility is derived
-from the selected Session's real K1 capabilities rather than its name. A
-compatible source may therefore report capability `pass` independently from
-executor readiness.
+Two source-independent definitions are projected by the portable catalog:
 
-That portable foundation is not an executable product path yet. Its executor is
-`not-installed`, and there is no accepted server-side definition-SHA/check-SHA
-fenced check/submit API, generic v2 result assembler/publisher or deployed Worker
-executor. Preflight consequently remains blocked and the UI must not promise or
-expose enqueue. The old `missioncore.lab-v1-vegetation-shadow/v1` result is not an
-exact/existing result of the generic portable definition, even for its original
-source; it remains available only in the immutable legacy LAB catalog.
+- `LAB V1 · EoMT Cityscapes Large 1024 + DDRNet-39` seals the exact
+  model/component/resource identities and the
+  `missioncore.recorded-eomt-ddrnet-review/v2` result contract;
+- `M4.9T5 · TRAVEL TGS · CPU-only, без ML` v2 seals an explicitly empty model
+  manifest, dynamic source-derived frame counts, causal TGS invariants and the
+  `missioncore.recorded-tgs-costmap-review/v2` result contract.
+
+Neither portable definition contains a source Session id, label, fixed frame
+count or filesystem path. Compatibility is derived independently for every
+setup from the selected Session's real K1 capabilities. A compatible source may
+therefore report capability `pass` while that setup's executor remains blocked.
+Blocked definitions stay projectable and do not prevent an unrelated ready
+definition from entering the durable queue allowlist.
+
+The server now owns a definition-SHA/check-SHA fenced portable check/submit
+boundary. Submission still fails closed unless that exact definition has a
+sealed `ready` executor release and image and is present in the durable queue.
+Both repository portable definitions currently declare `not-installed`, so
+their preflight remains blocked; no release or image hash is fabricated. The
+generic v2 assemblers, verified publisher and Worker transport exist as a
+dormant fail-closed implementation, but exact executor installation, central
+storage, authentication, tunnel acceptance and end-to-end canaries remain
+pending. The old `missioncore.lab-v1-vegetation-shadow/v1` result and the exact
+RAVNOVES00 M4.9 result remain only in their existing immutable catalogs;
+neither is reclassified as a result of a portable definition.
 
 Recorded work has priority rank `100`. A future live K1 lease has rank `0` and
 closes new recorded claims while it is pending or active. Cooperative executors
@@ -342,8 +355,10 @@ foundation. The production app hard-disables the Worker router even when a valid
 credential is present until an expiring claim lease and verified result publisher
 are accepted. Installation of the exact executors, Worker deployment and wiring
 from the real K1 lifecycle to live-lease triggers remain pending. Therefore a
-submitted M4.9T5 job may honestly wait in `queued` without implying that Worker
-006 can execute it yet; portable LAB V1 cannot currently be submitted at all.
+submitted exact legacy M4.9T5 job may honestly wait in `queued` without implying
+that Worker 006 can execute it yet. Portable LAB V1 and portable M4.9T5 cannot
+currently be submitted because their executor states are `not-installed` and
+the authenticated Worker dispatch gate is closed.
 
 Worker telemetry remains secondary observation evidence. It does not replace the
 authoritative queue ledger, result validation or common laboratory receipt. K1