Follow up placement response binding and local-network disclosure #144

Transport hardening follow-ups from Codex on PR #10 at e426883, nonblocking under the tightened08:30Z convergence rule.

• Response binding, review4114652186: the client decodes stats.input_sha256 but does not compare it with submitted scene bytes. The current server binds parse/solve to each POST body and hashes input_bytes; no normal-path stale-response reproduction was supplied. Add the comparison as defense in depth with a deliberately mismatched-result test, not as a claim that the current server mixes homes. Keep sample-result behavior explicit.
• Local networking, review4114652176: the documented laptop-server workflow has NSAllowsLocalNetworking but no local-network purpose string. Verify permission behavior on a real device and add an accurate purpose declaration if needed. No device denial reproduction was supplied to this caretaker.

These do not supersede the verified chosen-spot, raw/corrected evidence, retention or consent safety gates. Owner: S3 transport/configuration.