feat(run): stamp the drill's SDK build in the dry-run run-config [skip-docs]

The K8 drill captured a run-config that described the rig it rehearsed —
model ids, parameters, caps — without saying which SDK build would drive it.
The SDK's reported USD figure is computed against a price table frozen at build
time, so a rig record without the build is not traceable, and the drill exists
precisely to rig a future live run.

build_dry_run_config now takes the client the drill constructed and reads the
build from it, the same seam rule the provenance stamp follows: a drill driven
by the scripted stand-in stamps null rather than the installed version, because
reading the environment would describe a rig that never existed (§1).

Load-bearing (§11): the two new tests went RED before the change (no such key),
and the detach point is named in the class docstring — read importlib.metadata
instead of the client and the scripted drill claims a build it never used. The
existing dry-run tests assert individual keys rather than a key set, so the
additive field leaves them untouched, and byte-determinism still holds.

624 -> 627 passed, ruff + mypy --strict clean. README states the new field.
STATE post 2a, approved by the operator this session.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MQu2xxwedckjU56byu1aUG

src/portfolio_optimiser_claude/run.py

@@ -443,6 +443,7 @@ def write_value_report(
 def build_dry_run_config(
     contracts: Contracts,
     *,
+    client: ModelClient,
     profile: str,
     bundle_name: str,
     run_id: str,
@@ -461,11 +462,18 @@ def build_dry_run_config(
     NO wall-clock date: the outbox promises byte-determinism (same input + run_id
     ⇒ identical file), and the run's date is stamped at report time (§4 pt 3),
     never into the deterministic log.
+
+    ``client`` is the client the drill CONSTRUCTED (never called): the rig's SDK
+    build is read from it, the same seam rule the provenance stamp follows. A
+    drill driven by the scripted stand-in used no SDK and stamps null — reading
+    the installed version from the environment would describe a rig that never
+    existed (§1).
     """
     return {
         "run_id": run_id,
         "profile": profile,
         "bundle": bundle_name,
+        "sdk_version": _client_sdk_version(client),
         "models": {
             role: resolve_model(contracts.model_map, role, profile=profile)
             for role in (_PROPOSER_ROLE, _CHECKER_ROLE)
@@ -793,6 +801,7 @@ def main(
         )
         run_config = build_dry_run_config(
             contracts,
+            client=client,
             profile=_DEFAULT_PROFILE,
             bundle_name=args.bundle.name,
             run_id=run_id,