workforce-validation: remove importable view issuer that bypasses authorized read path

[seonghobae]

Finding

PR #235 made ValidityStudyView(...) fail closed, but exact predecessor 7c71f81c63ff87d6524fd565b3b5ce444905ca2e still exposed module-level _issue_validity_study_view(...). An ordinary caller importing the implementation module could call that helper directly with arbitrary tenant/study IDs and fields and receive the same ValidityStudyView runtime shape without Keyverse authorization, repository read, persisted-record reconstruction, or target binding.

The view is intentionally data-only rather than a reusable credential, so this is not a claim that a Python runtime type can be cryptographically unforgeable. The defect was an API/ownership contradiction: the module stated that ordinary issuance belongs to read_validity_study(...) while simultaneously exposing an unconditional issuer.

Test-first repair lineage

• dbb0d251a5b2b2fa6bee558febe74a8e6bd33c59 adds test_registry_module_exposes_no_unconditional_view_issuer. Against its production predecessor, the test is causally RED because _issue_validity_study_view still exists. The test-only head was superseded before hosted execution, so no hosted RED is claimed.
• 656a0c41c06bc517b2cf7c554e35a6fb4f8c4f4b removes the module-level helper and constructs the tuple-backed data projection directly inside read_validity_study(...) only after purpose-bound authorization, owner-port read, exact persisted-record reconstruction, and immutable target verification. The production delta is confined to registry.py; SQL/schema/global migration/Keyverse ownership and fix(workforce-validation): revalidate canonical principal storage before authorization #239–fix(workforce-validation): validate exact UUID payload before sentinel comparison #244 ordering are unchanged.

No secret/sentinel/process-local capability was introduced. Low-level tuple.__new__ fabrication remains irrelevant as authorization authority because the view is explicitly a data projection; consequential downstream actions must re-authorize and re-resolve authoritative state.

Exact-head acceptance

Current #235 head is 656a0c41c06bc517b2cf7c554e35a6fb4f8c4f4b on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f and remains Draft/mergeable. Exact-head CodeRabbit review completed with no blocking defect in the requested #245 scope and explicitly confirmed the test-first predecessor, absence of the helper at current head, issuance ordering, #239–#244 preservation, Foundation workforce-validation/unit + isolated PostgreSQL gates, dependency-hygiene source-path requirement, and matching manifest seal. This is independent static evidence, not a qualifying GitHub approval or hosted GREEN.

Foundation 33963422971, CodeQL 33963422783, SAST 33963422887, and Security 33963422859 remain non-terminal at the latest read. No current-head hosted GREEN, executed PostgreSQL GREEN, 100% owned statement/branch coverage, terminal security completion, or qualifying approval is claimed.

Keep this issue open until exact-head hosted owned coverage/PostgreSQL/security acceptance, qualifying review, and protected integration complete, or a verified successor carries all delta/evidence.