Add supplied frozen coordinate chart with executed validation gates

[junpenglao]

Summary

Adds a supplied (frozen) affine-flow coordinate chart to tuningfork, together with the
algebra needed to validate it. The chart is handed complete parameters and evaluates them; it
learns nothing.

Not in this PR: no fitter, no chart-selection rule, no warmup descriptor, no execution
recipe, no registry entry, no sampler integration, and no changes to BlackJAX or to any existing
tuningfork file. Every file here is new. No sampling, mixing, efficiency or posterior-accuracy
claim is made anywhere, and no chain is run.

The chart

In preconditioned coordinates z = L^{-1}(q - center), a constant affine field

V(z) = alpha * z + a * (h . z) + c

is constrained at construction to ||h|| = 1, h . c = 1, h . a = -alpha. Those three
constraints make the clock rate identically one, d/ds (h . z) = 1, which yields three
consequences exact in real arithmetic:

1. the last chart coordinate (the clock) advances at unit rate, so it is readable as t = h . z;
2. the inverse is closed-form — flowing back by t lands on the section h . z = 0, with no
   iteration and no root find;
3. log|det J| = alpha (d-1) t + log|det L| is the exact log-Jacobian.

These are identities of the map, not statements about its floating-point evaluation. The
implementation's finite-precision behaviour is a separate matter and is treated as such below.

CONVENTION_VERSION identifies the coordinate and series conventions the module fixes: clock-last
ordering, the reflector orientation, and the per-dtype series crossover.

Delivered surface

The chart implementation is private; only the convention identifier is exported. The private
constructor does two distinct things and does not conflate them:

• Projects — h is normalised, and c and a are projected so that h . c = 1 and
  h . a = -alpha hold by construction.
• Refuses — representation preconditions are enforced rather than repaired: non-zero h;
  matching, non-zero scale; declared shapes for a, c, center and a scalar alpha; finite
  a, c, alpha, center; finite low-rank basis and eigenvalues, checked before any spectral
  work; strictly positive eigenvalues; and orthonormality of the spectrally active basis
  columns.

Orthonormality is scoped to active columns deliberately. Columns with unit eigenvalue contribute
exactly zero to the preconditioner at every power and zero to the log-determinant, so requiring
orthonormality of them would refuse legitimate inputs carrying a neutral direction.

log_det is a log-absolute determinant, so a negative scale entry is supported: it flips
orientation without changing the volume element.

phi serves float32 and float64 only. Half precisions raise rather than falling back. The
reason is directional: a coarser dtype wants a larger crossover, so falling back to the float64
constant moves the wrong way, and a silent fallback would be worse than no support.

What is checked

• Algebraic identities — the structural constraints; the closed-form log-Jacobian against
  slogdet of the AD Jacobian, near and far from the origin; the two-sided inverse; the supplied
  score against a reference; and invertibility of the score pullback. Diagonal and low-rank
  preconditioners, including an active factor and a neutral column.
• Gates — a valid chart, a wrong log-determinant, a wrong score, non-finite providers, and a
  chart built without normalising h. Gate success requires finiteness as well as agreement:
  a reject-if-error-exceeds comparison does not reject NaN, because NaN > tolerance is false.
  Explicit finiteness checks handle non-finite values.
• Special cases — a pure reflection, an exercised low-rank factor, a non-normal generator, and
  a table of representation violations against a baseline that is separately asserted to
  construct, so a mistake in the fixture cannot make every row vacuously pass.
• phi — values and derivatives against an independent 60-digit decimal oracle at named
  points: zero, small arguments, either side of each crossover, and a large-argument case where
  the direct form cancels. These are agreements at those points. No accuracy bound, floor or
  optimality is claimed for the crossovers or for either branch, and no global property is
  inferred from the sampled points.
• The clock residual — recorded as a runtime diagnostic and asserted only to be available and
  clean where the chart is well conditioned.

One methodological point the tests encode:

• The score reference is not hooked. Differentiating a custom_jvp density to test the score
  it supplies returns the rule under test, so the reference is the plain composed expression. For
  the same reason the inverse is tested as a supplied map: AD cannot manufacture a global inverse
  from the forward map alone.

Scope of the claims

The funnel case checks that, for that target's own scaling map, the transformed clock score is
affine in the clock with no section dependence, so the density factorises into a Gaussian clock
and a section marginal. The premise for that conclusion is stated in full in the design note: it
requires the identity to hold on the full real line, with a constant positive precision,
on a global Cartesian chart with global support. For a supplied chart those premises are
discharged by the algebra and the evaluations corroborate them; for a fitted chart they would
remain open. A residual measured on any finite set of points establishes none of them.

The clock residual is a component-specific detector, not a certificate. It observes error in
the clock coordinate and is blind to anything leaving that coordinate intact, so it certifies
neither the score nor the Jacobian; those are covered by the algebraic checks. A projection that
removes the residual is described in the design note and is not shipped — it would change the
implemented map and needs its own verification.

The overflowing-basis case establishes that a basis with finite entries and a non-finite derived
Gram is refused. It does not establish coverage of the non-finite-comparison path specifically:
on this backend that Gram reduces to an infinity, which a comparison-only gate would also reject.
The guard rests on the reasoning recorded beside it, not on that test.

Verification

Final-head CI at fa1f3fb62711726f8273a25b16cb414c41c5ba71:

job	result
pre-commit	success
test-fast (py3.13)	1977 passed, 6 skipped in 383.99 s
test-slow	142 passed, 2 skipped in 870.07 s

The modules added here trace JAX and run in seconds, so they are marked slow and run in the
slow job. Earlier heads of this branch carried different counts and, in two cases, failures; those
results belong to those commits and are not restated here. A local ordered single-worker check of
the added modules together with two previously affected cases was run at an earlier commit, and a
single-test check was run against a working tree that was not this commit; neither is offered as
evidence about this head.