PY-PORT-2f: port model_ladder_cells_produce.py to aprender-ci-tools ladder-cells-produce (C301) #5225

Sub-ticket of #4741 (PY-PORT-2, C301: the build is Rust only; Python stays only as an external oracle). Carries #4986.

Port scripts/lib/model_ladder_cells_produce.py (494 lines; stdlib argparse/hashlib/json/os/re/signal/socket/subprocess/time/urllib, plus the judge model_ladder_cells.py for the owed-set enumeration) to an aprender-ci-tools ladder-cells-produce subcommand, same shape as #4799.

Why now: #4986 (measure_code must read apr code's backend.ran / backend.fell_back, the shape measure_chat reads) cannot be committed to the .py. The pre-commit complexity check refuses any staged copy of the file on functions already over the limits on main (measure_item, cmd_measure, finish; the test double's main). The fix is written and passes scripts/check_ladder_cells_producer.sh (all cases and mutants, plus a new case and a new mutant for the code verb); it lands in the port instead.

Acceptance:

• Same subcommands and argv, byte-identical stdout (Python json.dumps key order and escaping) and the same exit status as the .py on a case table: every verb (run, chat, code, serve), every fake-apr mode (good, fellback, noneedle, refuse, noclose, undercount), and bad inputs.
• The ladder producer: measure_code should read apr code JSON backend.ran and backend.fell_back like measure_chat #4986 behaviour is in the port from the start: code cells carry backend (cuda/cpu from backend.ran) and fallback (backend.fell_back), never None when the document has them; a case and a mutant pin it.
• The parity harness scripts/tests/ci_tools_py_parity_test.sh gains the cases, with the .py side run on the ladder producer: measure_code should read apr code JSON backend.ran and backend.fell_back like measure_chat #4986 fix so the two agree; cargo-mutants on the module: 0 missed. Every function under the complexity limits (cyclomatic 30, cognitive 25).
• The .py and its callers stay (N-1): scripts/model_ladder.sh calls it on a certification path, and scripts/check_ladder_cells_producer.sh mutates it. They switch once a released aprender-ci-tools carries the port.

Refs #4986, #3597