Exercises the provider bundle path — verify sha256, unpack to the
content-addressed cache, symlink in at mount="data" so the config metadata_csv
path resolves. The loose-file config stays alongside it as the plain case.
400 rows / 200 patients, two samples each, so grouped splitting is actually
exercised. Signal is modest and noisy on purpose — a separable toy would score
1.0 with a broken model and prove nothing.
ryan