Fix remapping correctness and validate release installation routes

[Jaureguy760]

Standard phased numeric genotypes could be written as 0/1 characters in remapping FASTQs, and expected-copy metadata could disagree with the number of changed haplotypes written. Resolve genotype indices against REF/ALT and derive copy counts from emitted pairs, with exact sequence and remapping/filter acceptance checks.

Preserve PGEN phase orientation and sample ordering, correct dependency floors using numerical compatibility tests, and repair source/Pixi/Conda, Galaxy, Nextflow, documentation and tutorial installation paths. Refresh published rust-htslib/hts-sys patch releases and supported CI action releases. Remove unused setuptools and its vendored build helpers from runtime images. The allelic-imbalance statistical model is unchanged.

Release checks now install and exercise exact artifacts, reject empty SBOM inventories, collect runtime scans and SIF tests independently after build-image scan failures, reconcile immutable PyPI artifacts, and stage tested images by digest before promotion. Publication remains gated by successful container security checks and finalized signed-tag metadata.

Validation (candidate commit 92b5821; release run https://github.com/mcvickerlab/WASP2/actions/runs/38991076939):

• Local refreshed native build: 897 Python tests passed (14 optional historical-data skips, one deselected), 137 Rust unit tests passed, Clippy with warnings denied passed. Minimum scientific dependency environment: 733 passed, one skipped.
• Fresh wheel and source installations: 15/15 functional checks each, including exact counts, swapped sequences, real BWA remapping/filter decisions, cell/barcode matrix axes, and optional exports. Source members were compared byte-for-byte with the checkout. Twine and installed dependency consistency checks passed.
• The current matrix passes all 16 wheels, all eight Pixi environments and all eight Conda combinations. Intel macOS/Python 3.11 previously failed Conda relocation because the Mach-O header lacked space for updated load commands; the Rust build script now reserves that space. Both Intel Mac Conda packages and all macOS wheel relocation checks pass. The rebuilt wheel also passes a 528-byte relocation test locally. The final source archive matches all 69 corresponding checkout files, passes Twine, and installs into a fresh environment with 63 compatible packages and 15/15 functional checks.
• Core Python 3.10–3.13/Rust, Galaxy/Nextflow ecosystem, strict Sphinx, CodeQL, dependency/secret audit, lint and standard-build gates pass with the refreshed action pins.
• Both native release Docker architectures pass all 15 functional checks and SBOM inventory checks; their exact image archives are retained. The SIF built from the tested amd64 archive passes execution, and the repository Singularity definition builds and passes its test. Removing setuptools eliminated CVE-2026-23949 and CVE-2026-24049 from both runtime reports. Latest runtime scan archives were checksum-verified and confirm the remaining findings listed below.
• Illustrative RNA/ATAC Python tutorial cells execute through analysis, plotting and export. User-data and shell cells were excluded. No audit reports or downloaded datasets are committed.

Unresolved release blockers:

• Both runtime images still report 95 high/critical package findings across 32 CVEs; both build images report 521 findings across 301 CVEs. None lists an available fixed distro version. Applicability must be reviewed alongside remediation; Debian documents, for example, that CVE-2023-45853 does not affect its built zlib binaries: https://security-tracker.debian.org/tracker/CVE-2023-45853 . No blanket suppression was added. The container security gates remain failing.
• hts-sys 2.2.1 still bundles HTSlib 1.19.1 with the same CRAM decoder as 2.2.0. Cargo audit does not establish security of embedded C. Upstream advisories identify affected and patched releases: GHSA-5cj8-mj52-8vp3 and GHSA-28r7-prwc-hf5c . Updating the Rust bindings alone does not remediate these.
• rust-htslib has a GitHub 1.0.2 release, but crates.io reports 1.0.1 as latest and returns 404 for 1.0.2. The lockfile uses the latest published crate; unpublished upstream fixes require separate review.
• Finalize release date/changelog and final published source checksum before publication. Python/Cargo audits do not certify Conda native C-library vulnerabilities.

The Bioconda preparation recipe is pinned from Jaureguy760/bioconda-recipes commit 63b7dde03e1898a3aa52cb52943ae9e02d191ebe; CI substitutes only the exact tested candidate source URL/checksum. Upstream recipe submission requires the final published source archive.

Keep this PR in draft pending security remediation/triage and finalized release metadata. No release tag, PyPI package, registry image or upstream Bioconda package has been published; this PR has not been merged into dev.