feat: implement numbered patch-stack apply/verify enforcement (DGR-028)

Split the range-loader patch into single-concern patches 0002-0005 (loader,
filtered state report, boundary I/O endpoint guard, worker range-report
hook), add UPSTREAM-ASSUMPTIONS.json describing each patch's assumptions,
and enforce control-plane/license boundary checks plus first-incompatible-
patch reporting in scripts/llama_cpp_dependency.py apply/reverse/verify.

7 passed in tests/test_llama_cpp_dependency.py; SHA256SUMS verified against
all five patches; focused native CTest (test-meshnet-range-ownership 1/1)
recorded in evidence README (build/ dir not present in this environment to
independently reverify).

packages/node/native/llama/UPSTREAM_LOCK.json

@@ -10,16 +10,23 @@
     "method": "git-clone-detached-commit",
     "workspace": "build/llama.cpp"
   },
-  "patched_tree": "322d8b463df74a2226f0b513176643d815f54452",
+  "patched_tree": "c0045714735ae5ee7b7334a480d8ac04e03e1b18",
   "upstream_license": "MIT",
   "patch_series": [
     "0001-cmake-reserve-meshnet-patch-stack-abi-marker.patch",
-    "0002-dense-llama-owned-range-loader.patch"
+    "0002-dense-llama-owned-range-loading.patch",
+    "0003-owned-range-filtered-state-report.patch",
+    "0004-dense-boundary-io-endpoint-guard.patch",
+    "0005-worker-range-report-hook.patch"
   ],
   "patch_scope": [
     "Reserved CMake ABI marker only; no execution or model semantics.",
-    "Dense-Llama owned-range registration, mmap reporting, and native fixture tests."
+    "Range loading: dense-Llama owned-range params, validation, and filtered tensor registration with endpoint ownership.",
+    "Filtered state: owned-range report populated from registered tensors and backend buffers, derived never asserted.",
+    "Boundary I/O: endpoint ownership flags and a fail-closed dense graph guard until typed endpoint adapters exist.",
+    "Worker hooks: public C range-report API and the model-free native fixture test the project-owned worker binds to."
   ],
+  "patch_assumptions": "patches/UPSTREAM-ASSUMPTIONS.json",
   "build": {
     "generator": "Unix Makefiles",
     "cmake_minimum": "3.14",