Return the first permanently frozen CDF index instead of falling through to the account's stake. Mirror the policy in the same-precision oracle and pin current committee-scale outputs against high-precision and Boost references.

Add SelectF128 sortition implementation

armv7 (GOARM=7) has the same 32-bit int as 386 but on real ARM hardware like the Raspberry Pi. It has no native path on the amd64 runner, so it runs under QEMU via a foreign-arch container; the stock golang image carries gcc/g++ and Boost is vendored, so no extra install is needed. Emulated and thus the slowest leg, so it runs only the default rapid depth.

Go's int is 32-bit on GOARCH=386, the platform width that motivates the explicitly-int64 f128 exponent. x86-64 runs i386 user code natively, so this validates cross-GOARCH bit-identity with no QEMU; gcc/g++-multilib supplies the 32-bit toolchain for the cgo/Boost build (Go adds -m32 automatically).

Add exact, multiprecision, trajectory, metamorphic, and mutation checks for the f128 CDF walk.

Schedule certified Arb corpus verification and document the testing layers and developer commands in TESTING.md.

Add exact-integer primitive checks, an exhaustive small-domain boundary grid, and offline Arb-certified large-money quantile vectors.

Include the new tests in the curated mutation campaign and pin the optional oracle dependency.

TestSelectF128BoundaryStraddle stepped candidate digests by a fixed 2^128 digest units, which is one f128 ratio ulp only for boundaries in [0.5, 1); for small boundaries (a large-mean cdf(0) can sit at 2^-2000) the candidates landed many ulps away, diluting the straddle into ordinary sampling. Derive the step from the boundary's MantExp (2^(exp-128) in digest units, clamped to one digest unit when the ulp is finer than the digest grid), and assert the candidate window genuinely brackets the boundary whenever no candidate was clamped at the digest range's ends.