Add NNS upstream sync and fidelity automation

[OVVO-Financial]

This PR makes NNS-python the final downstream integration and parity layer in
the NNS sync chain:

OVVO-Financial/NNS
  -> OVVO-Financial/NNS-core
  -> OVVO-Financial/NNS-python

It also enforces direct R behavior fidelity from OVVO-Financial/NNS to Python:

               OVVO-Financial/NNS
                R truth source
                 /            \
       src/** native truth      R API behavior truth
              /                  \
OVVO-Financial/NNS-core       OVVO-Financial/NNS-python
              \                    ^
               \                  /
                v                /
              OVVO-Financial/NNS-python

Adds:

• sync/nns_source.json
• sync/r_api_map.json
• sync contract docs
• sync status docs
• script to vendor accepted NNS-core snapshots
• script to vendor exact R NNS snapshots
• R API parity planning script
• live R parity runner scaffold
• R API inspection script
• workflow to receive nns-core-updated
• workflow to receive nns-r-api-or-version-updated
• CI coverage for vignette examples if present
• tests for sync manifests and planning

Rules enforced:

• native code enters Python only through accepted public NNS-core commits
• R API behavior is tested directly against live R NNS at the recorded R commit
• R version changes require fresh live-R parity cache regeneration
• normal sync PRs must pass native build, invariants, parity, smoke tests, docs examples, ruff, mypy, and build

This PR is automation only. It does not change runtime behavior.

Validation run locally

Gate	Result
git diff --check	clean
pip install -e . --force-reinstall	built
pytest tests/tools	7 passed
pytest tests/invariants	317 passed
NNS_R_CACHE_ONLY=1 pytest tests/parity	1784 passed, 11 skipped (live-R-only)
pytest tests/parity/test_r13_smoke.py	6 passed
pytest tests/docs/test_vignette_examples.py	10 passed
ruff check .	passed
python -m build	sdist + wheel built (sdist now includes /sync)

mypy was run; the two new test modules are clean. Pre-existing mypy errors in
unrelated test files (unresolved numpy/pytest stubs in this container) are
not introduced by this change.

Manifest provenance note

r_src_tree_hash is set to the git tree object hash of the vendored R src/**
tree (tools/NNS/src). The r_commit and core_commit fields read unknown
until populated by a real upstream NNS / NNS-core sync event, since those
SHAs come from the upstream repositories rather than this repo. r_version is
13.0, taken from the vendored R DESCRIPTION.

If the workflow discovers that live R parity fails, behavior is not fixed in this
automation PR. A separate parity-correction PR should record the function,
arguments, R output, Python output, first divergent intermediate, and proposed
fix.

https://claude.ai/code/session_017KnASettwNxUdYJzchRLux

---

Generated by Claude Code