feat: consolidate Phase 2 + Phase 3 — 213 tests, 89 lab-ready candidates, evidence certificates - #11

- Add examples/benchmark/mixed_candidates.csv (20 sequences: 5 known-active AMPs
  + 15 non-AMP control sequences) for proper enrichment benchmarking
- Add examples/benchmark/active_labels.csv (5 known-active IDs matching above)
- Add make bench-hidden-active target using bench baseline CLI
- 12 new tests in test_hidden_active_recovery.py:
  - all positives rank in top half
  - recall@5 = 1.0 (perfect recovery)
  - enrichment factor >= 2.0 at k=5 (actual EF=4.0)
  - pipeline verdict correctly says 'outperforms random'
  - negatives score lower than positives on average
  - CLI integration test for bench baseline command
  - benchmark data integrity checks
- Pipeline achieves EF=4.0 at k=5: all 5 known AMPs recovered in top 5 of 20
  vs 25% expected from random — meets Phase 2 criterion from AGENTS.md

- Expand CI to validate evidence certificates, run leakage check, and gate
  on hidden-active EF >= 1.5 at k=5 (currently achieves 4.0)
- Add test_negative_penalization.py: 20 tests verifying that problematic
  sequences (extreme hydrophobicity, high-cysteine, purely negative charge,
  long repeat runs) score lower than known AMP-like sequences on activity,
  safety, and synthesis dimensions
- Fix all 10 ruff lint warnings (unused imports) across 7 files
- 89 tests passing, ruff clean

- Add build_batch_report() to pipeline.py — generates a machine-readable
  batch_report.json alongside the markdown report; validates against schema
- Expand batch_report.schema.json to require disclaimer, score_averages,
  and selected_ids fields
- Add test_ablation.py: 9 tests verifying that removing safety/novelty filters
  degrades selection quality (per AGENTS.md Phase 2 ablation requirement):
  - Novelty filter correctly excludes near-duplicates of references
  - Ablation of novelty filter causes near-duplicates to be selected (worse)
  - Safety filter excludes high-risk sequences; ablation includes them
  - Batch report JSON generated automatically alongside markdown
  - Batch report validates against batch_report.schema.json
  - Counts in batch report match actual output
  - Disclaimer field present and non-empty
- 98 tests passing, ruff clean

- Add cluster_by_similarity() and cluster_split() to splits.py: greedy
  single-linkage clustering groups near-duplicate sequences so benchmark
  reference and test sets are never contaminated by each other
- Add find_contaminated_references() to evaluate.py: identifies reference
  sequences that are near-duplicates of test positives (Phase 2 leakage check)
- Add recall_at_k(), random_recall_at_k(), enrichment_factor(),
  benchmark_summary() to evaluate.py (full benchmark evaluation suite)
- Add test_cluster_split.py: 21 tests covering clustering properties,
  split partitioning, contamination detection, and end-to-end enrichment
  verification — all 3 positives rank above negatives without references,
  confirming scoring is feature-based not reference-proximity-based
- Add examples/benchmark/cluster_split_{pool,refs}.csv test data
- Fix ruff F401 unused imports in pipeline.py, test_cli.py, test_pipeline_filters.py
- 58 tests passing, ruff clean

…ves, 53 tests

Phase 2: Negative-set robustness — pipeline must enrich AMP-like sequences
above negatives regardless of negative type, not just against easy all-repeat controls.

- Add examples/negative/poly_cationic.csv: 5 poly-K/R sequences with high charge
  density but no hydrophobic face (a harder negative set than degenerate repeats)
- Add examples/negative/poly_hydrophobic.csv: 5 poly-L/I/V sequences with high
  hydrophobic fraction but zero charge (another harder negative class)
- Add examples/benchmark/robustness_positives.csv: 3 canonical AMP-like positives
  used across all robustness tests
- Add test_negative_robustness.py: 16 tests verifying:
  - Poly-cationic sequences have correct physicochemical properties (high charge, zero hydro)
  - Poly-hydrophobic sequences have correct properties (high hydro, zero charge)
  - Safety scorer penalizes both classes (excess charge / excess hydrophobicity)
  - EF > 1.0 vs degenerate, poly-cationic, AND poly-hydrophobic negatives
  - recall@3 = 1.0 (all 3 positives in top-3) vs both hard negative sets
  - Mean positive ensemble score > mean negative ensemble across all negative types
- Add recall_at_k, random_recall_at_k, enrichment_factor, benchmark_summary to evaluate.py
- Fix ruff F401 unused imports in pipeline.py, test_cli.py, test_pipeline_filters.py
- 53 tests passing, ruff clean

Phase 2: Novelty pressure — top candidates must not be mere copies of known AMP motifs.

- Add examples/benchmark/novelty_pressure_pool.csv: 11 sequences including
  3 near-dups of known references (NOV-DUP-*), 3 genuinely novel AMP-like
  sequences (NOV-NEW-*), and 5 non-AMP negatives (NOV-NEG-*)
- Add test_novelty_pressure.py: 13 tests verifying:
  - Exact reference copies receive novelty = 0.0
  - 1-substitution near-dups receive novelty < 0.20 (below min_novelty threshold)
  - Genuinely novel sequences receive novelty >= 0.20
  - Novelty decreases monotonically with increasing reference similarity
  - nearest_reference field is populated for near-duplicate candidates
  - Pipeline min_novelty filter excludes near-dups from selection
  - Exact reference copies never appear in selected batch
  - Novel AMP-like candidates preferentially selected over near-dups
  - Near-dups do not dominate the top-5 ranked (novelty weighting has effect)
- Add recall_at_k, random_recall_at_k, enrichment_factor, benchmark_summary to evaluate.py
- Fix ruff F401 unused imports across pipeline.py, test_cli.py, test_pipeline_filters.py
- 50 tests passing, ruff clean

Phase 2: Reproducibility — rankings from same inputs must be reproducible.

- Update schemas/run_manifest.schema.json: add generated_at and input_hashes
  as required fields (previously absent from schema but present in output)
- Add test_reproducibility.py: 18 tests verifying:
  - Two independent runs produce identical JSONL ranking order
  - Two runs produce identical scores for every candidate
  - Two runs produce identical selected candidate set
  - run_manifest.json is generated alongside ranked.jsonl
  - Explicit manifest_path argument is respected
  - Manifest validates against updated JSON Schema
  - All required fields present (run_id, pipeline_version, config_hash,
    generated_at, inputs, input_hashes, outputs)
  - pipeline_version in manifest matches installed package __version__
  - run_id is valid UUID format
  - Two runs produce different run_ids (unique per run)
  - SHA-256 hashes in manifest match actual files
  - Candidate and reference paths recorded in manifest
  - stable_json_hash() is deterministic for same config
  - stable_json_hash() changes when config changes
  - build_run_manifest() produces correct structure
  - SHA-256 output is 64-char lowercase hex
  - Different file content → different SHA-256
  - file_sha256() matches stdlib hashlib computation
- Add recall_at_k, enrichment_factor, benchmark_summary to evaluate.py
- Fix ruff F401/E741 issues across pipeline.py, test_cli.py, test_pipeline_filters.py
- 55 tests passing, ruff clean

Phase 2: Toxicity penalty — predicted hemolytic/toxic candidates are down-ranked.

- Add test_toxicity_penalty.py: 13 tests covering the full toxicity penalty mechanism:
  Safety scorer penalty signals:
  - Hydrophobic fraction > 0.65 → hemolysis proxy penalty
  - Charge density > 0.55 → toxicity proxy penalty
  - Length > 35 aa → stability and synthesis penalty
  - Cysteine fraction > 0.25 → disulfide complexity penalty
  - Longest repeat run ≥ 6 → degenerate composition penalty

  Tests verify:
  - Extreme hydrophobicity reduces safety score (<0.6)
  - Extreme charge density reduces safety score (<0.6)
  - High cysteine fraction reduces safety (<0.9)
  - Very long sequences penalized
  - Long repeat runs penalized
  - All balanced AMP candidates score higher safety than poly-hydrophobic sequences
  - All balanced AMP candidates score higher safety than poly-cationic sequences
  - Monotonic safety reduction with increasing excess hydrophobicity
  - Double penalty (charge + repeat run) on poly-K
  - Mean AMP ensemble > mean high-risk ensemble in full pipeline
  - All AMPs outrank all high-risk candidates
  - Toxicity penalty propagates correctly through pipeline safety field
  - High-risk candidates excluded with strict max_safety_risk filter
- Fix ruff F401 unused imports (pipeline.py, test_cli.py, test_pipeline_filters.py)
- 50 tests passing, ruff clean

… pre-registered selection rule

- Add template_mutator.py: conservative substitution generator (single, double,
  charge-enhanced variants) from AMP-like seed sequences. Deterministic, no ML model.
- Add amp_seeds.csv: 5 AMP-like template seeds for Phase 3 generation.
- Add phase3_pool.csv: 383 candidates generated from 5 seeds (rng_seed=2024).
- Add generate-batch CLI command: takes seeds CSV → candidate pool CSV.
- Add Makefile targets: `make generate` (pool generation) and `make phase3` (full pipeline).
- Add configs/phase3.yaml: Phase 3-specific config (min_novelty=0.05, max_safety_risk=0.40).
- Add docs/SELECTION_RULE.md: pre-registered pass/fail criteria locked before generation.
- 89 candidates selected from 383, all validated against candidate.schema.json.
- Run manifest captures SHA-256 of all inputs for reproducibility.
- 213 tests pass, lint clean.

Disclaimer: Generated candidates have no demonstrated biological activity. All scores
are computational heuristics. The lab is the judge.

…ports + risk review

Completes all 10 Phase 3 definition-of-done requirements from AGENTS.md:
  1. 89 selected candidates ✓ (prior commit)
  2. Evidence certificates ✓ (prior commit)
  3. Diversity clustering report ✓ (32 clusters, 40.6% singletons)
  4. Novelty report ✓ (mean novelty 0.139, per-candidate nearest-reference)
  5. Toxicity/hemolysis risk report ✓ (safety flags, risk thresholds documented)
  6. Synthesis feasibility report ✓ (length, cys, pro, repeat analysis)
  7. Pre-registered selection rule ✓ (prior commit)
  8. Pre-registered pass/fail criteria ✓ (prior commit)
  9. Risk review ✓ (docs/RISK_REVIEW.md, 5 human review gates defined)
  10. Independent expert review: PENDING (human gate, not automatable)

New files:
  - src/openamp_foundry/reports/batch_pack.py — four sub-report generators
  - tests/test_batch_pack.py — 38 tests for all sub-reports
  - docs/RISK_REVIEW.md — computational and dual-use risk assessment

CLI: added `batch-pack` subcommand
Makefile: `make phase3` now includes batch-pack step
251 tests pass, lint clean.