### `wai.neural.int_mlicpp` — the MLIC++ entropy topology at decode-equivalence

- New capability `wai.neural.int_mlicpp` (`wai-rs/src/int_mlicpp.rs`, behind
  `neural_int`): the channel-autoregressive × checkerboard entropy model of
  `wai.neural.mlicpp` — `K` channel slices, each decoded as an anchor pass then a
  non-anchor pass, an entropy network over concat[latent decoded so far, hyper]
  re-run before every pass — with the hyper-decoder, the entropy network and the
  synthesis all integer networks (`int_hyper_synth`), the scale → distribution step
  `int_entropy::det_build_index`, and the integer rANS. Registry: `NeuralIntegerExact`
  (decode-equivalence), `Lossy`, royalty-free (its decoder is this crate's; the
  patent status of the techniques it implements was not examined).
- Why: the float capability's validation run decoded to garbage while its encoder
  evaluated the entropy network at its runtime's default thread count and the
  decoder single-threaded — one scale fell on the other side of a table edge at
  symbol 416 of 12,288, and every later symbol decoded wrong. Matching the execution
  settings fixes that run; it remains a convention. Here every scale is an integer
  both sides compute exactly, so no thread count, runtime or platform can move a
  bucket.
- Wire: a `WIM1` payload (36-byte header, then the hyper-latent and latent rANS
  streams) and a one-file `WMB1` model bundle (three `WHM1` networks and the entropy
  tables), so a pinned prior's SHA-256 covers everything the reconstruction depends
  on. The neural dispatch decodes it (`decode_envelope`, `decode_envelope_strict`)
  and checks a pinned prior against the very bytes it decodes with.
- Totality: every value the stream controls is range-checked. Before the decode
  allocates anything, each network's shapes are derived from its layer geometry (the
  new `int_hyper_synth::net_shape`, which shares its geometry with the checked run):
  a header whose shapes the model does not produce, or on which any network would
  form a buffer — an activation, a transposed convolution's uncropped plane — over
  `Header::MAX_TENSOR` elements, is refused as a model that does not fit the payload.
  `tests/int_mlicpp_preflight.rs` counts allocations: refusing such a header
  allocates a few kilobytes at most, where the decode without the check allocated
  the tensors the header asked for, and on a synthesis wider than the cap aborted
  the process on a 3.4-petabyte allocation. Latents go through
  the new `int_entropy::dequantize` (`sym · 2^frac + base`, `None` where `i64` cannot
  hold it; Kani harness `kani_dequantize_is_exact_or_refused`), and every network
  through the new `int_hyper_synth::run_net_checked`, which runs `run_net` layer by
  layer only while no product, partial sum or requantised value can leave its type
  and refuses otherwise. A test moves one channel's scales across table edges: the
  stream leaves the encoder at the first moved bucket, and the decode is refused
  when the desynchronised latents would overflow the entropy network. With the
  accumulation check removed, a damaged copy of the committed stream panics the
  overflow-checked build.
- Conformance vector `wai-rs/tests/vectors/int_mlicpp/` (from
  `tools/wai_int_mlicpp_export.py`, deterministic in its seed): **synthetic
  weights**, quantised like a trained model's; no trained MLIC++ model is used, so it
  shows decode-equivalence and nothing about compression quality. A 64×64 image, 8
  latent channels in 4 slices, all 16 scale buckets used, 47 of 512 residuals and 5
  of 16 hyper-latent symbols coded by the rANS escape. The export computes its
  reference in numpy integer arithmetic under explicit int64 range checks and decodes
  its own rANS bytes back, pass by pass, before writing. Pinned: the RGB (FNV-1a and
  SHA-256) and FNV-1a over the bucket and symbol sequences.
- Evidence: decoded to the pinned bytes on macOS arm64 and on wasm32-wasip2 under
  wasmtime; x86_64 not measured locally (determinism-tiers §6). A golden in
  `byte-exact-conformance` puts it on the four-platform matrix;
  `tests/int_mlicpp.rs` runs on every `wai-conformance` leg in both profiles, and the
  dispatch test in `wai-neural-gates`.
- Registry tests now pin a recorded basis for every `NeuralIntegerExact` capability
  (`NEURAL_INTEGER_EXACT_EVIDENCE`), as `STANDARD_DEFINED_EVIDENCE` does for
  `StandardDefined`.
- `int_hyper_synth::IntModel::from_bytes`, the compact network form the integer
  neural decoders load, is total on damaged bytes. It reserved room for the layer
  count it read before checking that the bytes held that many layers — about 480 GB
  for a count of 2^32 − 1, which aborts wherever that allocation fails — and formed
  layer sizes and read offsets in unchecked arithmetic, which overflows a 32-bit
  `usize` (on wasm32 the first case panicked with a capacity overflow). Both are
  checked now, and a valid model parses to the same layers.
- `int_hyper_synth::run_net` now applies each layer through one function that
  `run_net_checked` shares, `run_net_checked` takes each layer's geometry from the
  function `net_shape` uses, and `decode`'s pixel quantisation is `to_rgb8`; all
  refactors, and every committed vector reproduces its hash.

