fix: enforce EventBuilder weight/team length in release

Part of #18. `EventBuilder::weights` guarded the length match with a
`debug_assert!`, so release builds accepted a mismatch, silently dropped the
weights, and ingested the event anyway. That is the exact shape #18 is about:
validation that exists only where it is least needed.

The setters return `Self` to keep the chain fluent, so they cannot return a
`Result`. The builder now records the first failure and `commit` returns it as
`MismatchedShape`. The weights are not applied on mismatch either, so a
partially-weighted team cannot reach the history by another route.

Two tests in tests/degenerate_inputs.rs, whose CI job runs in release — which
is the only place the old behaviour differed.

The second test needed strengthening before it was worth anything. As first
written it committed a ONE-team event, which ingestion rejects for an unrelated
reason, so it passed under a mutation that disabled the whole check. It now
uses two teams, so ingestion would otherwise succeed and the assertion is
actually load-bearing. Both tests were then mutation-proved together: disabling
the error path in `commit` fails both in release.

#18 stays open. The remaining debug_asserts live in `ranked_with_arena` and
`scored_with_arena`, and promoting those means threading `Result` up through
`Event::compute`, `TimeSlice::iteration`, `log_evidence` and `filtered_step` —
which lands on the public API as `log_evidence() -> Result<f64>` and
`filtered_learning_curve() -> Result<...>`. That is a trade-off about what the
query API should look like, not a mechanical change, so it is not mine to
decide.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5SYDExxL4vZgvunrcNSMc

tests/degenerate_inputs.rs

@@ -141,6 +141,54 @@ fn converge_on_an_empty_history_with_owned_keys() {
     assert!(report.converged);
 }
 
+/// A weights/team length mismatch used to be a `debug_assert!`, so release
+/// builds ingested the event with the weights silently unapplied. This file's
+/// CI job runs in release too, which is the point of pinning it here.
+#[test]
+fn event_builder_rejects_a_weights_length_mismatch() {
+    let mut h = History::default();
+
+    let err = h
+        .event(1)
+        .team(["a"])
+        .weights([1.0, 2.0])
+        .team(["b"])
+        .winner(0)
+        .commit()
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            InferenceError::MismatchedShape {
+                kind: "weights",
+                expected: 1,
+                got: 2,
+            }
+        ),
+        "expected a weights MismatchedShape, got {err:?}"
+    );
+}
+
+/// The mismatch must not be applied even partially — a half-weighted team
+/// reaching the history would be worse than the error.
+#[test]
+fn event_builder_weights_mismatch_leaves_the_history_untouched() {
+    let mut h = History::default();
+
+    // Two teams, so ingestion would otherwise succeed — a one-team event is
+    // rejected for an unrelated reason and would pass this vacuously.
+    let _ = h
+        .event(1)
+        .team(["a"])
+        .weights([1.0, 2.0])
+        .team(["b"])
+        .winner(0)
+        .commit();
+
+    assert!(h.learning_curve("a").is_empty());
+}
+
 #[test]
 fn empty_event_stream_then_converge() {
     let mut h = History::default();