Enforce capacity workload payload and history declarations

[rmcdaniel]

Problem

The versioned suite presents payload sizes and history shapes as exact workload identity, but the executable adapters are not checked against those declarations. For multiple-activities, the manifest declares 4,096-byte activity inputs for five sequential hashes; each PHP, Python, and Rust implementation feeds the 64-byte hexadecimal digest into activities two through five. For the mixed cell, the manifest declares 1,024-byte activity inputs and 512-byte activity results, while the controller creates a 2,048-byte workflow blob and the one-activity path echoes that full blob.

The controller exports history to derive latency, but it never validates the declared target event count or history shape. These differences can still receive the same suite identity and become publishable evidence.

Acceptance criteria

• Define byte-size semantics precisely at the encoded workload boundary and make every PHP, Python, and Rust activity invocation/result match the declared size for each step.
• Make mixed-shape generation honor the payload contract for the selected component workload.
• Validate the declared workflow/activity/signal/query history shape and target event count from runtime evidence before a result can be publishable.
• Fail closed when executable workload behavior drifts from the versioned cell declaration.
• Add cross-binding conformance fixtures for payload sizes and representative history shapes without turning prose labels into brittle assertions.

Delete when

Delete when every cell and first-party binding has executable evidence matching its versioned payload and history contract, and a mismatched payload or history cannot retain the same publishable suite identity.