Extend binding conformance with runtime-valid fixtures and exact verification coverage #79

ADR-0010 integration review against PR #76 at 2d84ac3 found two concrete gaps before a real RNGD serving binding can claim B2. This follows #75; it does not change the proposed byte-space contract or vendor-neutral storage code.

1. conformance/binding/conformance.py:verify_units() checks hashes only for entries returned by a binding. An empty verification list currently passes, and returned units are not matched to the planned coverage. Reject omitted, duplicate, out-of-bounds and unexpected units; validate every planned byte interval (or an explicitly permitted equivalent partition), both apply and rollback.
2. The kit creates arbitrary model.bin and a tiny config and starts a new binding CLI process for each operation. Real model runtimes need valid artifacts and persistent allocation ownership. Add an optional runtime-fixture/provider input and a documented CLI-to-owner transport hook. Preserve the same purity, wrong-base, non-same coverage, real readback, manifest and rollback assertions; retain existing synthetic defaults for neutral CI. CPU fake success must remain distinct from native serving conformance.

RNGD now consumes actual onggi.switchplan.v1 in rngd-pd PR #38 (strict parser source f0f08bf; 596 CPU CI tests pass). Its older performance planner and apply API still lack device-derived artifact-order digest verification and retained post-success rollback, so they are not advertised as B2. Some serving layouts are lossy (query scaling/F32→BF16) or host-only; target-file/host-shadow hashes cannot stand in for readback. The practical first serving scope is a declared lossless BF16 transpose/group/padding subset with explicit refusal outside it. Reload verification for noninvertible runtime representations needs a documented decision rather than a false digest claim.

Acceptance: malformed verification regression cases fail; generic reference tests continue passing; a fixture provider can supply valid artifacts without the kit learning a vendor format; one native owner survives operation subprocesses; reported native evidence and binding scope remain explicit. No native pass is claimed by this issue.