Audit 3/3: the evidence - red-first tests for every finding

[enoch85]

The evidence: ~96 new test files, each one written red-first against a defect that was live in production. Stacked on the production and simulator PRs; the tip of this PR is byte-identical to the audit branch.

What they pin, by area:

• Billing: the hour survives the clocks going back (PEP 495 fold); an hour the meter slept through is not a bill; a billing hour remembers where its samples came from; one definition of the billed quantity; one peak per day; v1 stores migrate instead of breaking setup.
• Control: an unloaded integration does not drive the heat pump (the race held open, as the network holds it open in production); the thermostat OFF switch actually turns it off; one writer at a time (AST-counted); reads do not drive the pump; a user boost outranks the price optimizer; wear and rate limits are real.
• Physics & models: the pump models match their datasheets (every EN 14511 point); the emitter law matches OpenEnergyMonitor to 0.00 °C; the simulated plant obeys physics (falsifiable bounds — water-node leak, per-step Carnot, datasheet-COP envelope); the plant engages aux where the pump does.
• Structural guards: no hardcoded values (ratcheted baseline); every simulator constant says where it came from; no document misquotes the safety thresholds; the rulebook describes this codebase; no fenced constant declaration a phantom; translation key parity across five locales; no production naive datetimes; no test captures the clock at import time.
• Known-open defects stay visible: F-124 (saturated compressor) is a strict xfail restricted to AssertionError — fixing the layer turns the suite red until the marker is removed; a crash can no longer impersonate the finding.

Run against main, this suite fails 556 tests and 40 files cannot import — the measured before/after of the audit.