[M1/Security] Persist digest-bound output assemblies and qualifications atomically

[samovers]

Parent: #167
Depends on: #171, #173, #177, #178, #181

Problem

Output authorization can occur outside the serialization transaction, qualification is not durably bound to the frozen artifact, and shortened content identifiers weaken collision/integrity guarantees.

Acceptance criteria

• Authority/revocation recheck, typed permission/redaction plan, materialization resolution, evidence sufficiency, document assembly, metadata, qualification, and publication result execute in one UnitOfWork.
• Persist the exact qualification and permission/redaction plan; bind their full digests/references into the frozen artifact receipt.
• Bind the artifact to tenant, actor, purpose, RuntimeBundle, valid-time/knowledge cuts, immutable basis/context snapshot, evidence set, materialization digest, and serializer/output-plan identity.
• Use full SHA-256 (or approved equivalent) content identities and verify canonical bytes on any identity reuse.
• A refused or failed freeze leaves no partial document, receipt, qualification, or published reference.
• Frozen content is immutable; later access, delivery mode, and redaction permission are re-evaluated per request without rewriting history.
• VIEW_ONLY and other non-export delivery modes cannot create a frozen/exportable artifact.
• Same idempotent request returns the identical durable artifact and complete qualification.
• A revocation committed before freeze commit prevents the freeze; race tests cover grant, evidence, materialization, and bundle changes.
• Add tamper, digest-mismatch, partial-failure, replay, concurrent-freeze, and historical-reconstruction tests.

Non-goals

External filing/transmission, signature or attestation, certification, current-compliance claims, PWA rendering, new output families, law/contract changes, or profile activation.

Integrated M1/M2 review addendum (2026-07-10)

Window-scoped completeness and annex integrity

• Every pending, exception, contest, unresolved-binding, and gap entry included in an output is selected using the same requested valid-time/knowledge-time window and boundary convention accepted in [M1/ADR] Specify valid-time and knowledge-time semantics #170/[M1/Correctness] Separate immutable materialization proof from disposable derived caches #181.
• Pre-window and post-window problems cannot leak into the annex; an exact boundary item appears in one adjacent window only.
• The completeness statement, visible annex, qualification, document metadata, and frozen bytes are computed from one closed source set at one temporal cut.
• Bind full digests/references for the exact annex and gap set into both qualification and artifact receipt; a metadata-only or annex-only substitution fails verification.
• Missing/unparseable/problem records refuse or qualify according to explicit policy; they are never silently dropped to make an output look clean.
• Add pre-window, post-window, exact-boundary, correction-moved-across-window, unresolved-binding, malformed-record, and adjacent-window duplicate tests.