Constrain certified cross-term gauge directions out of the solve space (#297)

[schroedk]

Closes part of #297 (goals 1 and 4; see below for 2 and 3). Stacked on #316.

A slope covariate another term reproduces per level puts an exact null in the design. The collinearity screen already finds it; here its warnings become proposals. After whitening, SlopeReparam builds a NullSpace — the one description of what the solve excludes: whitening's dropped columns plus the cross-term rows. Each proposal's direction is the per-level fit Aᵀc / diag(AᵀA) on its own term minus the fit on the other, net of the constant both share; the proposals are orthonormalized (pivoted, so a duplicate is spent against the row it duplicates) and each row n is certified by the backward error ‖An‖ ≤ 1e-11·√(nᵀdiag(AᵀA)n). Certified rows are projected out of the preconditioner apply (P M⁻¹ P); every warning records an AliasVerdict saying whether its direction was constrained or kept.

The LSMR audit measured Aᵀr in the preconditioner's metric, which cannot see a component in ker(M⁻¹) — exactly what the projector creates — so it now also requires the plain ‖Aᵀr‖ to have dropped.

Measured, 200k worker/firm/year panel, slope covariate = the year index, spectral floor off:

	λmax(M⁻¹)	iters	converged	max group mean
unconstrained	3.859e12	929	no	2.83
constrained	2.44	34	yes	1.7e-12
ridge 1e-10, unconstrained	2.036e6	34	yes	2.1e-12

Inert where the screen is silent (bit-identical), and declined where the direction carries information (near_collinear: λmax 1.2e8 kept, honest at ridge 0). The verdict is independent of the preconditioner and of a uniform weight scale.

Not in this PR:

• Goal 2 (Grounding on global energy): after the constraint, every remaining grounded block with a large response carries a real spectrum, so the local-surplus predicate is not load-bearing in any measured cell.
• Goal 3 (drop the spectral floor's default) is gated on A varying-slope covariate shared across two factors creates an undetected near-null two-way direction, blowing up iteration counts #281 — the near-collinear class the projection correctly declines is the fused block's, whose default is still None.