test: gate V1 side files and V3 legacy receipts; early output rejection

- analyze_jet_cv_continuation: samples are analyzed only if the sibling
  re*_s*.json receipt is the same case with run_status COMPLETE and
  source_recheck UNCHANGED; receipts without run_status (pre-recheck
  runners) are refused unless --legacy-receipts, and labelled
  LEGACY_NO_FINAL_SOURCE_RECHECK. Results carry receipt_gate.
- V3: receipts are schema 2 and need source_recheck UNCHANGED; a missing
  recheck is accepted only for frozen-mode schema 1 receipts whose
  run_case.py hash is one of the pre-recheck runners (9805383, 2cf9853,
  db3d098; hashes checked against git history in a test).
- V1/V3 refuse --output inside the checkout before source checks or CUDA
  (shared source_provenance.reject_output_inside).
- A failing recheck is recorded as RECHECK_FAILED (still invalid); the
  in-run V1 receipt write is tmp+replace.
Negative host tests for each gate. No threshold, solver or evidence edits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validation/taylor_green/run_case.py

@@ -182,6 +182,8 @@ def main():
         p.error("--run-gpu and exactly one explicit CUDA_VISIBLE_DEVICES are required")
     repo = args.repo.resolve()
     sys.path[:0] = [str(repo / "src"), str(repo)]
+    from tests.validation.source_provenance import reject_output_inside
+    reject_output_inside(args.output, repo)
     source = verify_source(repo, args.expected_revision, current=args.current_checkout)
     runtime = runtime_source(repo)
     if args.dry_run:
@@ -201,7 +203,7 @@ def main():
     masks = [k == ACTIVE for k in h.kinds]
     main_steps, early_steps = sample_steps(args.n, args.early_pressure)
     report = dict(
-        schema=1,
+        schema=2,  # 2: final source recheck (source_recheck) is recorded
         source=source,
         numerical_revision=None if args.current_checkout else NUMERICAL_REVISION,
         **({"source_mode": "current_checkout"} if args.current_checkout else {}),