feat: scienting-math/1 sources and derived/math.jsonl; lode references; stress fixes

Math content may say its source is in scienting-math/1's canonical TeX (form,
in no hash); derived/math.jsonl holds papermath's tree, symbols and issues,
and the validator now checks derived files. A symbol annotation names its
symbol by key; lode claim references use lode's tag and pin syntax. The zip
reader refuses entries zipfile cannot read, and checkpoint lines end in LF only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017R7sgDNvUGWY2zFPCq2JH6

spec/23-log.md

@@ -35,6 +35,7 @@ Q2xlYXIgdGV4dCBpcyBub3QgYSByb290IGhhc2guLi4uLi4uLi4=
 The origin names the log, and a team's logs are named `scient.ing/log/<store>` or under a domain the team controls.
 A signature line is an em dash (U+2014), a space, the signer's roster key, a space, and Base64 of the signer's four-byte key hash followed by the signature.
 The key hash is the first four bytes of SHA-256 of the signer's name, a newline, the byte 0x01 and the Ed25519 public key; the signature is Ed25519 over the note's first three lines, each ending in a newline.
+Every line of a note, the last signature line included, ends in one U+000A LINE FEED; a note that ends a line with anything else, such as U+000B, U+0085 or U+2028, which some libraries also take for line breaks, or that lacks its final U+000A, is malformed.
 A note parsed into JSON has `format`, `origin`, `size`, `root` as hex, `signatures` as `{name, key_hash, value}` and the `note` text itself; the schema is `checkpoint.schema.json`.
 `checkpoint.jsonl` gives a checkpoint over the example paper's receipts and its verification.