feat(p21): the PROJECT carries the price, so a run against a road normal can be anchored

Four paid stress rounds ran entirely UN-ANCHORED, all of them, because the one file
loader reads cost-baseline.json out of the BUNDLE and no vegnormal ships one: N100,
N200, N500 and R761 are knowledge, and knowledge carries requirements, never amounts.
The validator's stage 0 -- the one stage that tells an invented cost line from a line
this project actually buys -- was skipped in every single run, so "validated" could not
mean what it says. P20 G1/G2 measured real R761 process numbers (12.11 three times on
Soraasen, 1.1.1 on Lindaas) validating with amounts nobody had anywhere.

--cost-baseline FILE is PM decision (e), taken over the three alternatives P20 wrote
down. A LOADED object, never a path (prepass_payload's rule): the CLI owns the file and
loads it ONCE, so the notice, the stamp and every base of an --across-bundle pass all
descend from one read. ONE parse, two doors -- load_cost_baseline delegates to
load_cost_baseline_file -- while safe_resolve stays on the bundle door alone, because a
project's own schedule is legitimately outside every base. No tolerant twin: this path
exists only because an operator NAMED a file.

DEL B: five anchored context sets, a1-a3 with their line and a4 with none, so stage 0 is
what catches the falsification arm. THE ORDER'S OWN ARM (h) WAS FELLED BY MEASUREMENT:
"no baseline code is a requirement number the base declares" is measured 0 of 4 on the
project-coded sets and 5 of 5 on kontrakt-sorasen -- which is what R761 Prosesskoden IS,
a bill of quantities priced BY process code. The complement keeps both, and the order's
own mutation still bites.

DEL B3: the judge reports anchored (off the run's own stamp), priced per row, and WHICH
falsifier caught the falsification arm.

Load-bearing MEASURED, five mutations all red against the WHOLE suite, green control
1850/5 (from 1809/5, superset, 0 removed), golden byte-unchanged:
A3(i) the flag is read but the baseline is unused (3 red) . A3(ii) only the first base
gets it (1) . A3(iii) report_forbidden drops it (1) . B2(i) a4 gets a line (1, arm (g)
alone) . B2(ii) a code swapped to 12.11 (2, arms (f) and (h)).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/portfolio_optimiser/okf.py

@@ -1601,6 +1601,35 @@ def load_cost_baseline(bundle_dir: str, name: str = _COST_BASELINE) -> CostBasel
     resolved = Path(safe_resolve(bundle_dir, name))
     if not resolved.is_file():
         raise FileNotFoundError(f"cost baseline not found in bundle: {name!r}")
+    return load_cost_baseline_file(str(resolved))
+
+
+def load_cost_baseline_file(path: str) -> CostBaseline:
+    """Load a cost baseline from a file that is NOT inside a knowledge base: the PROJECT's own price
+    schedule (P21, ``--cost-baseline``).
+
+    The measured reason it exists. Four paid rounds (P16/P18/P19/P17b/P20) ran entirely UN-ANCHORED,
+    because the only file loader reads ``cost-baseline.json`` out of the bundle directory and no road
+    normal carries a price schedule: a vegnormal is KNOWLEDGE, and the price belongs to the PROJECT.
+    Stage 0 was therefore skipped in every one of them, and "validated" could not mean anything —
+    P20 G1/G2 measured real process numbers validating with invented amounts. This is the third door
+    into ``CostBaseline`` alongside the bundle file and ``derive_cost_baseline``, and the only one
+    whose input is the project rather than the corpus.
+
+    **The SAME parse, never a second one** (kø-(p)): ``load_cost_baseline`` resolves inside the
+    bundle and then delegates here, so the two doors cannot disagree about what a baseline file is.
+    What differs is the resolution — ``safe_resolve`` is the ONE in-/out-of-bundle test and stays on
+    the bundle door alone, because a project's own schedule is legitimately outside every base.
+
+    Fail-fast, the error CLASSES of ``load_cost_baseline``: a missing file raises
+    ``FileNotFoundError`` and malformed content raises ``pydantic.ValidationError``. There is no
+    optional twin, and that is deliberate: the bundle file is absent by default (a base authored
+    before the amendment is legitimately un-anchored), whereas this path exists only because an
+    operator NAMED a file — tolerating its absence would answer an explicit order with a silently
+    un-anchored run (``load_mandate``'s rule)."""
+    resolved = Path(path)
+    if not resolved.is_file():
+        raise FileNotFoundError(f"cost baseline not found: {path!r}")
     return CostBaseline.model_validate_json(resolved.read_text(encoding="utf-8"))