scientific(coverage): reject undeclared fields in persisted shard rehydration #736

Finding

#735 adds owner-issued JSON rehydration for persisted CoverageCalibrationShardRecord, but the private serde wire structs use default unknown-field behavior. serde therefore ignores undeclared object members while still accepting the record as shard schema v1.

That weakens the stated recovery contract in two places. A resumed/distributed acceptance run can ingest a payload carrying stale or misspelled provenance/outcome fields without failing closed, and a future producer can accidentally add semantically material fields while retaining schema_version = 1; the current reader silently discards them. AGENTS.md requires serialized payloads to be treated as untrusted until the owning boundary validates their schema and scientific semantics.

Required RED / repair

• add a source RED showing an extra top-level shard member is rejected rather than ignored;
• add a source RED showing an extra per-outcome member is rejected rather than ignored;
• keep the persisted record fields private and continue reconstructing indexed outcomes only through validation_core constructors;
• make the private wire types deny unknown fields so schema-v1 accepts exactly its declared object surface;
• preserve current responsibilities: scenario equality/full tiling stay with final assembly and coverage-value/denominator arithmetic stays with validation_core;
• do not weaken or bypass existing malformed schema/source/fingerprint/range/identity checks.

Boundary

This is fail-closed persisted-schema recovery, not external-storage authentication and not execution of the 10,000-DGP acceptance run. It does not define a numerical-failure acceptance threshold or promote #680.

Refs #639 #680 #734 #735.