memory: syntactic certification is exhausted, with controls

[austinamissah]

Adds 07-syntactic-certification.md: three closed routes to a stream-agnostic dead-gate certificate, each paired with a passing positive control, and the mechanism they share.

The target is the 46,286 CCX/CCZ (3.35% of the score, 43,237.5 avgT) that fire on none of the 9,024 official shots. The strict-beat bar is 0.802 avgT, so one certified gate is a submission -- but "never fired on this draw" cannot survive its own use, since the inputs are a SHAKE256 hash of the op stream (04-traps.md section 1).

1. Cooling. No gate is charged on fewer than 4,330 of 9,024 shots and zero are cold. Every CCX/CCZ has c_condition = NO_BIT, so all conditioning comes from PushCondition blocks carrying Hmr outcomes, which are independent of the quantum controls -- hence the 0.5 band is a fair coin (mean 0.5000) and P(a gate's ~2,256 firing shots all land inside a fair coin's 4,512) = 2^-2256. Ceiling on the lever, granting a perfect oracle condition to all 1,347,438 gates, is 991,429 avgT = 76.74% of the score, and it is unreachable.

2. Census sampling. Cannot certify the 46,286: a sampler observes firing and has no access to why a gate is quiet. This is the mechanism behind the depth-dependence 03-proven-floors.md already records under "Dead-gate census -- OVER-drawn, not dry".

3. Affine relations over GF(2) with hash-consed AND terms. Not one gate has controls sharing a single atom; 6,754 of 1,342,695 terms collapse, the remaining 1.23M nonlinear terms are distinct.

All three reason about the FORM of a value. This circuit computes modular inversion and multiplication, so affine structure survives only through CX/X chains uninterrupted by any CCX, and no such chain reaches any control pair. Certifying any of the 46,286 needs a semantic argument over GCD data invariants -- plausibly BMC or SMT over one divstep lifted by induction.

Sections 1 and 3 are measured on the certified frontier cf5aa02; the instrument reproduces four entries of 06-research-status.md's table exactly (avgT 1,291,859.302, total Toffoli 11,657,738,337, ops 9,062,420, Q 1,154). Section 2 is on 6909d15 and says so.

Retains repro/hotness.rs, which is self-gating: it aborts unless the attributed charge reconstructs the scorer's own Toffoli total. That assertion caught a 9,216-shot draw that was plausible to the eye and wrong. Built like hyperplane_mitm.cpp -- copied out, compiled, scratch removed. constzero.rs and affine.rs stay in the fork but need no patching to run against an unmodified checkout.

Happy to also add a repro/hotness.rs row to 06-research-status.md's Retained files table and a §1 row to its Refuted-or-exhausted table -- left those out to keep this reviewable.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}