Replay completed metadata events across Profile and tool upgrades

[KimGLee]

Problem

After the metadata-owner protocol is adopted, an adopter can no longer upgrade its selected Profile or metadata implementation once a closed batch has produced current page-property owners.

check_queue currently re-compares two immutable producer-era facts against the live Profile and metadata implementation:

• completed core events that own last_content_modified or last_reviewed; and
• the opening/closing transition receipts of already-closed batches.

The receipt graphs remain internally valid and still bind the exact page semantic fingerprint, but a later Profile normalization or tool-byte upgrade changes the live Profile/metadata fingerprints. Runtime validation then rejects the adopter before adopt_standards can run. This creates an upgrade deadlock: adopting the new Standards requires valid current runtime, while current runtime rejects historical evidence solely because the software has advanced.

Profile Gate-owned enum state is different: it represents present authorization under the selected Profile and must remain bound to the live Profile.

Required behavior

• Validate completed last_content_modified / last_reviewed evidence as immutable producer-era event evidence: exact target, date/value, semantic content fingerprint, receipt graph, and internally consistent Profile/metadata bindings.
• Do not require those historical event bindings to equal today's live Profile or metadata implementation fingerprint.
• Continue to require Profile Gate-owned enum fields to match the live typed Profile and metadata contract.
• For open / merge-ready work, keep strict live Profile/metadata validation of the current opening baseline.
• For terminal closed history, validate the opening/closing receipts and close bundle internally, without reinterpreting them through today's Profile/metadata bytes.
• Add regression coverage proving a Profile/metadata upgrade remains admissible with valid completed-event owners and closed transition history, while stale Profile Gate state still fails closed.

Non-goals

• Reissuing or rewriting historical receipts.
• Weakening semantic-content fingerprint checks.
• Allowing stale Profile Gate-owned state.
• Adding an Atlas-specific compatibility path.

[KimGLee]

Implemented in PR #130 after a whole-system evidence-lifecycle audit.

The repair uses one shared policy rather than call-site exceptions:

• current authorization: compare against the live Profile and metadata contract
• active transaction: compare against the live Profile and metadata contract
• completed event: replay the canonical producer-era identity and keep target, value, receipt, and current semantic-content bindings exact
• terminal history: replay the internally bound producer-era receipt graph without reinterpreting it under later Profile bytes

Profile-owned Gate state deliberately remains live-strict. Atlas migration now passes all four previously blocked historical-evidence checks; only the adoption plan snapshots that legitimately changed remain to be refreshed after merge.