brettleehari: fair-ordering a red-team of the coordination layer + the primitive that closes it

Description

The pitch.

[Hackathon] brettleehari: fair-ordering — a red-team of the coordination layer + the primitive that closes it

## Thesis
In an agent marketplace the **sequencer** sets the execution order of a batch — and *whoever authors that order can extract value from it* (front-running / MEV). Every coordination plugin in the tree assumes an **honest sequencer**: `contract_net` and `hotstuff` (merged), plus the open consensus/auction PRs (sealed-bid #5, PBFT #45, NandaQuorum #44, ResonanceBFT #58). **None addresses ordering fairness** — they answer *who agrees* and *who wins*, never *what if the orderer is the adversary?*

This PR doesn't add another "fair sequencer" (any single design breaks — I broke five). It ships a **systematic red-team of the ordering design space** and the one primitive that survives it, with an integrity oracle keyed on the engine's forge-proof `corr` — never on anything the sequencer wrote.

## The red-team result (six witnesses, one theorem)
| Scheme | Who authors the order | Result |
|---|---|---|
| sort commitments by hash | grinding **trader** (nonce grind) | pos 0 in tens of hashes, 100% — degenerates to a priority-gas-auction |
| beacon over **public** commits | **last-mover** trader | pos 0 in ~N hashes |
| beacon over **private** commits | **omniscient sequencer** (holds all commits) | pos 0 in ~N hashes |
| beacon + sequencer-commits-first | sequencer via **selective inclusion** | pos 0, 28/30 seeds |
| FIFO by **sequencer-polled** commits | sequencer via **emission order** | reverses arrival for free (on the real engine) |
| **FIFO by self-broadcast commits** | **the engine** (`corr` id) | **survives** — arrival order holds regardless of sequencer behavior |

**Theorem (empirically witnessed): whoever authors the order exploits it.** Every *sequencer-authored* scheme leaks. The escape is the last row — author the order with something the sequencer cannot see or forge.

> **Evidence scope (honest):** rows 1–4 are offline red-team scripts (pure-Python, stdlib-only, deterministic), reproducible on request and detailed in the appendix — not committed, per charter (no offline deps in the diff). Rows 5–6 are proven in-repo by the committed scenario + tests (`test_neutral_order_is_engine_authored_not_sequencer`) — so the survivor *and* the break of sequencer-polled FIFO are reproducible here.

## The survivor: engine-authored FIFO
Tier-1 stamps every broadcast with a monotonic, engine-assigned **`corr` id** the sequencer cannot forge (the trace has no `seq` field and all `ts` are `0.0`, so `corr` is the *only* neutral order signal). Traders **self-broadcast** in `on_start`, so arrival order is authored by `corr`, not the sequencer — confirmed on the real engine: a predatory sequencer emitting in reverse **can** reorder under polling but **cannot** under self-broadcast, which is why the scenario uses it. The integrity validator reconstructs arrival order from the submit `corr`s and asserts the executed order matches.

## What's in the PR
- **`coordination/fifo_fair.py`** — `FifoFairCoordination` (survivor: executes in arrival order) + `PredatoryCoordination` (matched attacker: reorders by descending price).
- **`scenarios_builtin/fair_ordering.py` + `scenarios/fair_ordering.yaml`** — 1 sequencer + 8 traders; traders self-broadcast, sequencer finalizes.
- **Two `corr`-keyed validators** — `fair_ordering_integrity` (executed order == engine arrival order) and `fair_ordering_no_injection` (every submit executed exactly once; no censorship, no phantoms).
- **Tests** — plugin units + scenario/discrimination/determinism/robustness.

## The discrimination (the teeth)
Same scenario, swap one line — this ranks three *plausible* sequencers, not just the absent default:

| `coordination:` | `fair_ordering_integrity` | `fair_ordering_no_injection` |
|---|---|---|
| `fifo_fair` | **PASS** | **PASS** |
| `predatory` | **FAIL** (reordered) | PASS (reorders, doesn't drop) |
| `contract_net`

…