Audit round: fair OMA reference, dense grids, covariance-attack checks

Resource-match the OMA reference in the key-length sweep (oma_ser_keylen),
which gives it the L/16 combining gain the longer frame allows. The
proposal now passes a resource-matched OMA by 1.27x at L=64 rather than
the 4.3x reported against a fixed-d reference.

Densify the JSR, sensitivity, and brute-force grids so the curves are
smooth, give the index cipher its channel floor instead of error-free
reception, and add the permutation-key known-plaintext attack
(exp_permkpa) so Fig. 7 carries a conventional linear scheme.

Add check_cov_attack.py and check_cov_ceiling.py: a referee raised a
ciphertext-only second-order attack; the exact-population test shows the
received covariance leaks only a sparse rank-deficient subset of the key
Gram and leaves the eavesdropper at the random-guess level.

Dump verify_math.csv, move the superseded V=256 pilot CSVs to data/pilot.

code/verify_math.py

@@ -33,9 +33,13 @@ def masks(U, d, rng):
     return M / np.linalg.norm(M, axis=1, keepdims=True) * np.sqrt(d)
 
 
+ROWS = []                      # (tag, claim, emp, err, tol, verdict)
+
+
 def report(tag, claim, emp, tol, extra=""):
     err = abs(claim - emp)
     ok = err <= tol
+    ROWS.append((tag, claim, emp, err, tol, "PASS" if ok else "FAIL"))
     print(f"[{'PASS' if ok else 'FAIL'}] {tag}: claim={claim:.5g} "
           f"emp={emp:.5g} |err|={err:.2g} tol={tol:g} {extra}")
     return ok
@@ -195,6 +199,16 @@ def main():
     }
     print("\nsummary:", {k: ("PASS" if v else "FAIL") for k, v in results.items()})
     print("ALL PASS" if all(results.values()) else "SOME FAILED")
+    # stored artifact so every quoted verification number has a raw file
+    import csv as _csv
+    from pathlib import Path as _Path
+    data = _Path(__file__).resolve().parents[1] / "data"
+    with open(data / "verify_math.csv", "w", newline="") as f:
+        w = _csv.writer(f)
+        w.writerow(["check", "claim", "empirical", "abs_err", "tol",
+                    "verdict"])
+        w.writerows(ROWS)
+    print("[csv]", data / "verify_math.csv")
 
 
 if __name__ == "__main__":