feat(research): add offline Treasury ten-year rates parser

[Pigbibi]

Summary

• Add a Treasury-specific, standard-library-only parser for caller-supplied nominal/real ten-year XML bytes and explicit per-row publication/receipt/revision evidence
• Emit the existing QSP rates-input.v1 shape; preserve unknown publication/value evidence, causal projection, exact raw-hash binding and visible conflict rejection
• Add 48 synthetic tests, including late same-day revisions and malformed XML scalar/null regression coverage

Scope

Exactly two new files. Existing CSV providers, catalog/consumer registration, dependencies, workflows and QSP v1 behavior are unchanged. There is no downloader, clock, filesystem, broker/model call or position authority. Reported breakeven is not manufactured. First-seen time is not substituted for publication time. Real source rights, authenticated publication, historical PIT, economic qualification and runtime adoption remain unverified. A proposed forward-known-at contract is outside this PR.

Verification

• Fresh main base: 447144a; all 81 baseline blobs unchanged
• Baseline suite: 104 passed; candidate suite: 152 passed under an offline external-action audit, zero forbidden attempts
• Fixed actual QSP observer at 9f02eeeed7d5b4c05cc284206f4b4a17040e04ea (blob c6fdc43ffc0edae18c4bf34654f22979745f49a6): 16 cross-repository synthetic cases passed, without adding a dependency
• Independent read-only review reran all 152 tests and found no remaining blocking issue after eight malformed-scalar/null regressions were fixed
• Local Ruff 0.15.20 passed; this PR's CI must verify the repository-pinned Ruff 0.15.22 and actual CI Python version
• Local Python 3.12: offline setuptools build backend produced sdist/wheel matching final source; the python-build frontend was unavailable locally
• Official Treasury XML documentation structure examples were inspected; no actual market-data feed was requested

Boundary

Source-only research preparation. Synthetic/parser success does not establish a qualified source or authorized strategy consumption.