chore: declare matplotlib and apply three behavior-preserving nits

- pyproject.toml: add a figures extra with matplotlib (used by the two figure
  scripts) so the environment is reproducible from pyproject alone.
- partition.py: correct the partition_eval_split docstring (simulated per-client
  eval sets from the global split, not client-owned held-out data).
- protean_cnn.py: extract_embeddings now moves batches to the model device.
- posthoc_statistical_audit.py: refuse to write an empty table.

scripts/posthoc_statistical_audit.py

@@ -55,6 +55,8 @@ def write_csv(name: str, rows: list[dict]) -> None:
     # never touch any pre-existing analysis artifact.
     if not name.startswith("posthoc__"):
         raise SystemExit(f"refusing to write non-posthoc artifact: {name}")
+    if not rows:
+        raise SystemExit(f"refusing to write empty table: {name}")
     path = ANALYSIS / name
     with path.open("w", newline="") as fh:
         w = csv.DictWriter(fh, fieldnames=list(rows[0].keys()))