spec(port): port the padding byte entropy guard (Refs #8884)

[dmitrii-f-t27]

Refs #8884 (CR-CHAT-04 ring tracker). Parent epic: gHashTag/trios#1812 (W2, own lane, T-PORT). Seventh W2 target delivered: statistical indistinguishability of padding bytes — non-empty, length bounds (16..65536), not one repeated byte, ≥8 distinct values, no byte over the 4/10 frequency ceiling — D5 verdict, original rule order, all ten PBEG tests transcribed plus helper, branch, boundary and rule-order tests (14 total, 0 vacuous). The BTreeMap count becomes a fixed 256-slot table indexed by the byte (the conventions' form), initialized from a literal (uninitialized bindings fail rustc E0381 — measured). The original's PBEG-03 discards its verdict; the port asserts the same bytes' deterministic outcome (TooFewUnique, got 2), and the byte-too-frequent branch gains the direct test the original never had. t27b 14/14 native; t27c 14/15→14/14, 0 vacuous; gen-rust compiles under rustc (0 errors, 0 &'static str, 0 Vec<const); coverage Untested 0; seal all hashes MATCH; ledger row included (pass, 28/28 untouched). Dedup checked. Sequencing: one-line ledger rebase if the earlier lane PRs land first — I take it on request.

[dmitrii-f-t27]

Merge request for the gHashTag merger: steward READY (required all SUCCESS; the red ones are non-required per Q16 and red on master too). Ledger row included; one-line rebase if the earlier lane PRs land first — I take it on request.

[gHashTag]

Carried unchanged, with its original author, as one commit of #10097 (tracking #10096). That PR lands all 25 green CR-CHAT-04/07 ports at once, because each single PR kept conflicting on the ledger rows before its CI could finish. Closing this one so its queued jobs free the Actions queue.