Preserve published Evidence Record IDs across v0.1.3

[AMBRA7592]

Summary

Adds the production coexistence layer required before the v0.1.3 correction can be frozen or promoted.

• preserves every v0.1.2 event ID and exact canonical body in an all-generation backing store
• keeps evidence_records as an active-only compatibility view for the currently deployed frontend during migration
• imports v0.1.3 additively and inactive, with metadata/corpus/hash assertions and a complete one-to-one transition gate
• supports guarded activation and rollback through the same stored transition map
• scopes every feed, corpus summary, and trial/patch evidence lookup to the explicit active generation
• resolves superseded HTML and JSON IDs without redirecting or rewriting canonical bytes
• publishes successor metadata through HTML/headers and an always-revalidated /events/supersessions.json index
• documents the production ordering and rollback procedure without freezing, deploying, tagging, or publishing v0.1.3

Storage and activation

Migration 007 renames the physical table to evidence_record_store, adds package-generation metadata and supersession mappings, and creates an active-only evidence_records view.

The exporter now has two explicit modes:

• --truncate --package-generation ... --activate-generation for local/bootstrap databases
• --evidence-only --package-generation v0.1.3 --supersedes v0.1.2 for additive production staging

An additive export cannot activate itself. Generated SQL checks inserted record/trial/membership/rule-hash totals, source-versus-target corpus metadata, and the complete transition map before committing. Activation rechecks row count, one rule hash, canonical hashes, and a complete map while holding an exclusive generation-state lock. The forward predecessor-to-successor map also authorizes a checked reverse activation; CI proves forward activation, rollback, and reactivation.

Generation corpus/severity totals are import-attested metadata for the frozen generation, not mutable live aggregates. A missing active generation is an unavailable state and returns HTTP 503 rather than displaying a zero-count corpus.

HTTP contract

• current, superseded, and exact known inactive IDs query the all-generation store
• inactive candidates return 200 with x-trialdiff-record-status: inactive for hold-stage byte verification but remain absent from feeds, links, totals, and the discovery index
• superseded canonical JSON remains byte-identical with its original ETag
• no JSON redirect and no canonical-body mutation
• unknown HTML and JSON IDs remain 404
• HTML and the supersession index use max-age=0, must-revalidate
• canonical JSON remains public, max-age=31536000, immutable
• inactive staged successors cannot make the active predecessor appear superseded before activation

Verification

Local:

• 95/95 Python tests via unittest
• Astro check: 0 errors/warnings/hints
• production build passes
• root and frozen-package manifests pass
• zero working-tree changes under trialdiff/, records/, or any frozen event-class package directory

CI run #24 is green across Python 3.11, Python 3.12, and the PostgreSQL/frontend contract. The PostgreSQL 16 job proves two frozen generations, inactive staging, hold-state exact bytes and non-enumerability, no-active HTTP 503, forward activation, reverse rollback, reactivation, 190 retained rows, 95 complete fixture mappings, zero canonical mismatches, exact old/new HTTP bytes, offline verification, supersession metadata/index, bodyless 304, and unknown-ID 404 controls.

Scope boundary

This PR does not regenerate or freeze v0.1.3, touch Neon/Vercel/Zenodo, create a tag or release, or modify any frozen package or implementation-hashed TrialDiff source. Independent read-only audit passed at 570d7cb; its two non-blocking consistency notes were closed at ca236d8, with CI run #24 green. The PR remains draft/HOLD pending owner merge authorization.