[Fellowship Challenge] Lab: bounded voting finality under delayed ballots

Description

The pitch.

Submission for the Hexaware x Project NANDA Fellowship Technical Challenge

## Gap
The stock Lab ballot box publishes at nominal close even when a ballot is delayed. It later accepts that ballot. In the control run, the recorded counts become 2–2 while `total` remains 3.

## Contribution
Track: Lab. Contribution: a new `voting_finality` scenario and `deferred_ballot_box` role. The fault uses the default transport layer's delay rule; no layer plugin is changed. The role waits a bounded time for missing voters, publishes one copied result, and records ballots received after finalization as rejected.

## Fault and invariant
The first ballot is delayed by 4 seconds. Nominal close is t=3.5, delivery is t≈4.7, and grace ends at t=5.5. The result must be published once, with counts, total, complete/missing fields, and broadcasts that agree with accepted ballots. The protected run passes. The same setup with the stock role fails `bounded_finality` and `tally_integrity`.

## Evidence
- Protected bundle: sha256:02b6743abddb750acd6f5d9d8d15a956b1448fc5aa9e4da33d2583149a98cfbb
- Stock control bundle: sha256:ad52c94b96e9efd3bebec9bc1b2b3ff677b2f768857d464ec16fc952f829b4af
- `nandatown verify` passes on both bundles, including the deliberately failed control.
- 41 focused tests pass. Both new scenarios are included in the built wheel and source archive.

## Local test note
From an LF checkout on Windows, the full suite has 1,722 passed, 26 skipped, and 13 failed. The same 13 tests fail on unmodified `main`; they exercise Windows file permissions, prohibited filename characters, and paths containing spaces. The repository's distribution checker compares Windows backslash paths with forward-slash archive names, so I inspected the archives using normalized paths: all 15 runtime files and 60 fixture/schema/example files are present.