feat: strict native signal validation and v7.2.0

[PakitoSec]

Summary

• Make SignalEnvelope the complete transport contract: schema_version, kind, source, verdict, weight and confidence are required.
• Reject blank sources, boolean/string numeric coercion, non-finite numbers, negative magnitudes and invalid confidence.
• io_load_signal preserves the producer judgment without inference; io_dump_signal validates construction inputs and completes before emission.
• Keep provider-specific payload validation outside Cyvest.
• Bump Python and JS packages and signal schema to 7.2.0; investigation schema remains 7.1.0.

Compatibility

Intentional input-contract tightening in 7.2: partial envelopes from all readable 7.x versions are now rejected. Complete valid 7.0/7.1 envelopes remain readable. Producers should use io_dump_signal or emit all required fields. Native received envelopes must not be repaired with the construction helper.

Validation

• Full Python test suite
• 54 JavaScript tests, JS builds and TypeScript checks
• 134 offline phishing-assassin consumer tests against local Cyvest
• Ruff checks and formatting, strict MkDocs build
• Source/wheel builds and twine check
• Published schema constraints and non-inference regression tests

Consumer changes are in a separate repository and are not part of this PR.