iter embedding-abi-m5.3 (DONE 3/3): time-shard boundary-invisibility proof + friction harvest

Final functional M5 iteration (spec ae905de, plan 67027ab; on
green m5.1 204c171 + m5.2 b724cd1 whose leak-proof resolved via
dbd76e5). Proves the chunk/window-boundary-invisibility claim the
M4 retirement rests on:

- adapter::fold_window — purely additive windowed sibling of
  fold_symbol (same MidPriceStream+Kernel path; stream_tick_windowed).
  fold_symbol/MidPriceStream/Kernel byte-untouched.
- chrono as a DEV-dep only — the time-shard test derives
  (y,m)->Unix-ms bounds (data-server's own precedent) and passes
  raw ms to the bin; the bin is date-math-free; Invariant 1
  unaffected.
- new single-responsibility [[bin]] timeshard_runner — one thread
  per disjoint window, each owning its Kernel (Ctx:!Send =>
  compile-time per-thread-ctx).
- tests/timeshard.rs — spec §3 strength-ordered: (a) per-shard
  (acc,n) BIT-EXACT vs single-thread host fold of that exact window
  in stream order (THE boundary-invisibility proof); (b) Σ partials
  bit-exact by construction; (c) whole-window within REL_TOL=1e-6
  only (cross-shard f64 reassociation is host arithmetic, never a
  kernel property — bit-exact there would be the bug; tolerance
  derived from the recursive-summation error bound). Plus the
  now-deterministic leak-Σ + a journal-only friction timing capture
  (no bench gate, no timing assertion).

Concrete pin: EURUSD 2017-03/04/05 (recon-verified present,
contiguous, no gaps; data-server has no month-listing API). RED was
a genuine deterministic compile failure (declared-but-absent bin
source; Cargo missing-source error vs the plan's predicted env!
error — same cause, no false-green; benign plan-text imprecision in
Concerns).

Boss-verified independently: timeshard determinism 5/5 (no jitter);
full ail-embed suite 0 failed AND 0 ignored across all binaries
(m5.2 symbol_fan_swarm_leak_free stays un-ignored & green — the
saga's resolution intact); isolated embed_rc_global_stats_race
still green; AILang workspace data-server count 0; compiler-surface
diff empty (zero diff to crates/ailang-*, crates/ail/, runtime/,
examples/*.ail, root Cargo.toml, DESIGN.md).

Friction-harvest deliverable (P2 flat-array-decision input):
host-per-tick-FFI ~= 658 ms / 3,192,562 ticks ~= ~206 ns/tick at
real EURUSD volume.

M5 functional work complete; milestone closes next via the
mandatory audit (which also handles the pre-existing
DESIGN.md:2358-2360 "additive M4 concern" drift, out of m5.3 scope).
Includes the per-iter journal, stats, and the INDEX.md line.

ail-embed/src/adapter.rs

@@ -68,6 +68,25 @@ pub fn fold_symbol(
     Some(Kernel::new().run(MidPriceStream::new(it).take(max_ticks)))
 }
 
+/// Fold the mid-price stream of `symbol` restricted to the inclusive
+/// Unix-millisecond window `[from_ms, to_ms]` through the M3 kernel.
+/// `None` if the symbol has no tick stream in that window. The window
+/// is the bound (no tick cap): the result is `(Σ mid, count)` over
+/// exactly the records data-server yields for that window, in stream
+/// order — identical f64-add sequence to a single-thread host fold of
+/// the same window, hence bit-exact against it. The windowed sibling
+/// of `fold_symbol`; same `MidPriceStream` + `Kernel` path, only the
+/// data-server entry differs (`stream_tick_windowed`).
+pub fn fold_window(
+    server: &Arc<DataServer>,
+    symbol: &str,
+    from_ms: i64,
+    to_ms: i64,
+) -> Option<(f64, i64)> {
+    let it = server.stream_tick_windowed(symbol, Some(from_ms), Some(to_ms))?;
+    Some(Kernel::new().run(MidPriceStream::new(it)))
+}
+
 #[cfg(test)]
 mod tests {
     use super::tick_to_px;