[sudoshi]

What changed

• Replace the environment-specific catalog release UUID pin with an exact semantic identity: dataset key, three immutable SHA-256 evidence fingerprints, grouper version, and all governed aggregate controls.
• Preserve the environment's actual release UUID in each demo patient's catalog lineage and projection binding digest.
• Make read-only verification reject altered account catalog preferences.
• Add fail-closed tests for evidence-fingerprint drift and release-state drift.
• Update the implementation plan and evidence checkpoint with the read-only production reconciliation and remaining activation sequence.

Root cause and impact

The first production preview made no writes and correctly stopped because the fixture-generated release UUID differs from production even though both represent the same governed release evidence. Generated database identifiers are provenance, not portable content identity. This correction keeps production fail-closed while allowing the exact governed release to reconcile across environments.

This PR does not activate the care-pathway catalog, enable Nightingale serving gates, run migrations, or provision any account by itself.

Validation

• Cohort feature suite: 15 scenarios, 369 assertions
• Full Patient suite: 210 tests, 3,580 assertions
• Laravel Pint: 1,939 files
• Gitleaks: working tree and exact one-commit range, no findings
• Prettier: both changed Markdown files
• Patient disclosure, accessibility, and API-contract checks
• App identity uniqueness: seven iOS and two Android identifiers, all unique
• No-tracking gate
• git diff --check