Require frozen eCPS baseline certificates

[MaxGhenis]

Summary

• emit a frozen eCPS baseline certificate from the sound replacement comparison payload
• require the mp300k eCPS comparison gate to validate that certificate against the pinned benchmark manifest
• replace the brittle eCPS full-loss-decrease recovery requirement with an effective-refit/no-op check

Why

The 2cdd45d MP promotion passed on a mis-scored eCPS surface. This makes the certified eCPS baseline H5, target DB, scorer commit, target surface, scoring config, and baseline metrics part of the required release contract so a live recomputation or metric drift cannot pass the artifact gate.

Verification

• uv run --with pytest python -m pytest tests/pipelines/test_ecps_replacement_comparison.py tests/pipelines/test_mp300k_artifact_gates.py -q
• uv run --with ruff ruff check src/microplex_us/pipelines/ecps_replacement_comparison.py src/microplex_us/pipelines/mp300k_artifact_gates.py tests/pipelines/test_ecps_replacement_comparison.py tests/pipelines/test_mp300k_artifact_gates.py
• uv run --with ruff ruff format --check src/microplex_us/pipelines/ecps_replacement_comparison.py src/microplex_us/pipelines/mp300k_artifact_gates.py tests/pipelines/test_ecps_replacement_comparison.py tests/pipelines/test_mp300k_artifact_gates.py