Preserve channel names through checkpoints and scene rendering

[marpaia]

Closes #18.

Add optional typed species/signal metadata at the model boundary and carry it through native controller continuation, live reset, checkpoints, and standalone scene export. Numerical indices remain channel identity; labels are safe presentation text with missing-name fallbacks and duplicate-name disambiguation. Include a named native model and explicit SBML name/identifier mapping.

Checkpoint v9 protects metadata with its own digest and reads versions 1–8 unchanged. Scene v3 adds ordered channel metadata; Python and TypeScript authenticate original v2 documents before migration. Unnamed and legacy models need no new mandatory protocol member. Named low-level checkpoints require the metadata-preserving bundle loader, with an explicit error instead of silent metadata loss.

Validation:

• Full Python suite: 337 passed, 56 environment-dependent skips.
• 43 viewer tests and production build pass; pyright has 0 errors and one pre-existing native-source warning.
• Shared Python-authored v3 fixture, malformed/count/integrity cases, older scene/checkpoint compatibility, periodic checkpoints and resume, live reset, Unicode, duplicate/missing names, and SBML mapping.
• Real Chromium verifies selectors, legend, inspector, literal HTML-like labels, and numerical selection retention. Reproducible script: viewer/browser/channel-labels.mjs.

Independent PR against master. #16 replay and #19 composite controls consume these APIs; their combined acceptance passed on the campaign validation branch.

Scene readers and Python capture/encoding now enforce a documented budget of 4096 channels independently for species and signals before expanding metadata. Tiny v2/v3 documents claiming 4097 or uint32-max channels fail with a format error; boundary cases pass. Legacy checkpoint metadata remains compact and native counts are unchanged, including a real 4097-species restore regression.

Independent review corrected two displayed-name collisions: literal names that imitate generated index suffixes, and distinct names that HTML option whitespace normalizes identically. Display-only normalization and collision-safe final indexing preserve raw metadata and numerical channel identity. Four regressions failed before the fixes; actual Chromium option/legend/inspector checks and 4,412 independently generated label-group checks pass at 9838289.

Independent review is complete against the original acceptance criteria and intended review base. The review report records per-criterion evidence, both corrected campaign findings, exact tested heads, landing order and platform limits.

Merged into master in the approved campaign order: #26, #27, #28, #31, #34, #36, #29, #30, #33, #35, #37, #32. The final tree preserves the reviewed implementation and integration regressions. Prerequisites were integrated with merge commits, and the frozen review bases were retained.

Landing validation: 534 Python tests passed (57 environment-dependent skips), 115 viewer tests passed, Ruff lint, strict type checks, viewer build/format checks, and actual Chromium feature/integration checks passed. Pyright retains the existing native-extension source warning. A Windows-only documentation link-test encoding failure was reproduced and fixed with an explicit UTF-8 read; the corrected final PR heads passed Windows CLI/shutdown checks and CUDA compilation. NVIDIA runtime execution remains unverified.