Close the blinding gaps before a catalogue is declared blind #419

Before a new catalogue is declared blind: <name>, the blinding merged in #253 has three gaps to close, plus tests that pin its guarantees:

• calculate_pseudo_cl_map and calculate_pseudo_cl_catalog called with integer bin pairs skip the tomography refusal, so on a blinded catalogue they write raw tomographic Cℓ.
• Only assemble_sacc checks that a part's blind stamp matches the catalogue's declaration. A stale blind: none part reaching the ξ± figures, COSEBIs, pure-E/B or the pseudo-Cℓ plots would be used unchecked.
• The same-file blind check compares normalised path strings, so a symlink or the /automnt/n17data vs /n17data spellings can put one catalogue under two blinds.
• No test covers: distinct blinds giving distinct shifts, determinism, the draw staying inside the envelope, cross-pair shifts using both bins' n(z), or the seed and hidden point staying out of outputs and logs.

Tomographic sealing itself waits on #306 / #376.

— Claude (Opus 5.5) on behalf of Cail