v0.9.0-beyond-sota

## Beyond-SOTA `v2/crates/` sweep + every stub implemented for real

Verified-audit-driven release: replaced every production stub with real, tested logic — **no labels, no placeholders, no fabricated numbers**. Each fix is pinned by a test that fails on the old code; every performance number ships with a reproduce command.

**Validation:** `cargo test --workspace --no-default-features` → **3,122 passed / 0 failed** · `python archive/v1/data/proof/verify.py` → **VERDICT: PASS** (bit-exact) · CI: 34 checks green.

### Headlines
- **Soul Signature §3.6 matcher made real** (`wifi-densepose-bfld`, #1021) — was a no-op `NullOracle`; now a real per-channel matcher (364 tests). Measured: same-person 1.0000 / cross 0.8088; WiFi-only channels alone are **not separable** (gap 0.0005). Named identity honestly **data-gated** — no working-named-identity claim.
- **OccWorld** — `Tensor::randn` stubs (priors from pure noise) → real deterministic conv VQ-VAE + `weights_trained` honesty flag.
- **MAT (ADR-158)** — unified two divergent triage engines (gate==record); killed survivor count-inflation (3→1 dedup); real ESP32/UDP/PCAP ingest + honest typed errors for hardware-gated adapters.
- **Native `wlanapi.dll` FFI** — measured 9.74 Hz multi-BSSID scan (no fake 10×); real Matter 1.3 pairing-code packing.
- **HOMECORE** — real intent runner + exact cosine k-NN semantic match + real SQL search.
- **Sweep ADR-154–157** — dead CIR gate revived; 7 PCK/OKS metrics unified; crafted-input DoS panics closed; honest GDOP; measured perf wins (PSD 2–3×, DTW 2.4–4.1×, fuse 2.17×, ORT 1.48×).

### Honesty boundary
Hardware/data-gated paths (Intel5300/Atheros/PicoScenes CSI, OccWorld weights, named identity) ship real code + typed errors / flags — never fabricated data, never an unmeasured accuracy claim.

Full detail: CHANGELOG `[Unreleased]`, ADR-154–158, PR #1023, issue #1021.