sampler: validate public inputs and isolate RNG

[huangyz0918]

Summary

• Validate observation noise, budgets, target/source indices, label columns, and finite real scores at the public boundary.
• Reject target leakage through duplicate label columns and preserve model names containing label_ when loading scores.
• Keep seeded sampling on a local RNG without changing global NumPy state.
• Reject complex and date/time values, including NumPy scalars hidden in object arrays.

Paper compatibility

Section 2.1 defines a real-valued score function. Validation therefore accepts finite scores outside [0, 1]; it does not impose a binary/probability range. The existing DICES-specific conversion is unchanged.

Reference: https://arxiv.org/html/2604.23099v1#S2.SS1

The pre-existing GMM feature and abstention differences found in the paper audit are handled separately in #17.

Verification

• Unchanged repository suite: 123 passed, including PyTorch paths.
• Local checks exercise malformed inputs, arbitrary real scores, target leakage, RNG isolation, and plan()/estimate() parity with sample().
• Independent dense GP calculations agree with acquisition choices, posterior means, marginal variances, and integral variance to numerical precision.
• Only production bug fixes are included. Additional validation code stays local; no credentials or live API calls are involved.