feat(p21): the PROJECT carries the price, so a run against a road normal can be anchored

Four paid stress rounds ran entirely UN-ANCHORED, all of them, because the one file
loader reads cost-baseline.json out of the BUNDLE and no vegnormal ships one: N100,
N200, N500 and R761 are knowledge, and knowledge carries requirements, never amounts.
The validator's stage 0 -- the one stage that tells an invented cost line from a line
this project actually buys -- was skipped in every single run, so "validated" could not
mean what it says. P20 G1/G2 measured real R761 process numbers (12.11 three times on
Soraasen, 1.1.1 on Lindaas) validating with amounts nobody had anywhere.

--cost-baseline FILE is PM decision (e), taken over the three alternatives P20 wrote
down. A LOADED object, never a path (prepass_payload's rule): the CLI owns the file and
loads it ONCE, so the notice, the stamp and every base of an --across-bundle pass all
descend from one read. ONE parse, two doors -- load_cost_baseline delegates to
load_cost_baseline_file -- while safe_resolve stays on the bundle door alone, because a
project's own schedule is legitimately outside every base. No tolerant twin: this path
exists only because an operator NAMED a file.

DEL B: five anchored context sets, a1-a3 with their line and a4 with none, so stage 0 is
what catches the falsification arm. THE ORDER'S OWN ARM (h) WAS FELLED BY MEASUREMENT:
"no baseline code is a requirement number the base declares" is measured 0 of 4 on the
project-coded sets and 5 of 5 on kontrakt-sorasen -- which is what R761 Prosesskoden IS,
a bill of quantities priced BY process code. The complement keeps both, and the order's
own mutation still bites.

DEL B3: the judge reports anchored (off the run's own stamp), priced per row, and WHICH
falsifier caught the falsification arm.

Load-bearing MEASURED, five mutations all red against the WHOLE suite, green control
1850/5 (from 1809/5, superset, 0 removed), golden byte-unchanged:
A3(i) the flag is read but the baseline is unused (3 red) . A3(ii) only the first base
gets it (1) . A3(iii) report_forbidden drops it (1) . B2(i) a4 gets a line (1, arm (g)
alone) . B2(ii) a code swapped to 12.11 (2, arms (f) and (h)).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -750,6 +750,25 @@ when the seam is detached, so the loop cannot silently degrade into theater.
     --derive-cost-baseline --require-cost-baseline
   ```
 
+- **The project's own price schedule** — `--cost-baseline FILE` (requires `--bundle-dir` or
+  `--across-bundle`). A knowledge base carries what is REQUIRED, not what things cost: a road
+  normal, a standard or a regulation has requirements and no amounts, so a run against one has
+  nothing for the validator's stage 0 to reconcile against and that stage is skipped. The price
+  belongs to the project, and this is where you hand it over: FILE is a `cost-baseline.json` — the
+  same `{"project_id": …, "items": {"<code>": {"quantity": …, "unit_cost": …}}}` shape a bundle may
+  ship — and it is used INSTEAD of one inside the base. With it, a proposal naming a cost line the
+  project does not buy is refused as a fabricated line, and one naming a real line with invented
+  magnitudes is refused with the real ones named, so the next attempt can correct.
+
+  In `--across-bundle` mode the same schedule anchors every base: one project, one price schedule.
+  Mutually exclusive with `--derive-cost-baseline` (two sources for one baseline), and it satisfies
+  `--require-cost-baseline`. A missing or malformed file refuses the run before anything starts.
+
+  ```bash
+  uv run python -m portfolio_optimiser.run PROSJEKT-1 --bundle-dir <bundle> \
+    --cost-baseline prisskjema.json --require-cost-baseline
+  ```
+
 
   `--explore` is refused together with `--mandate` — they are two sources of one mandate, and
   merging would silently overwrite what you wrote. To seed an exploration with a domain expert's