fix(job-analysis): reject executable audit time before durable canonicalization #197

Verified defect and owner correction

Fresh inspection of #65 originally exposed an executable audit-time boundary. A duplicate consumer-side test/fix attempt on #65 was fully removed by ordinary non-force successors after owner mapping showed the shared contract already belongs to PR #63 (fix/core: protect canonical evidence runtime types). No duplicate production source or test remains on #65.

#63 requires exact built-in datetime evidence before construction-time timestamp detachment, freezes accepted provider time to an inert UTC built-in instant, and requires canonical export to consume an exact built-in UTC timestamp. Its adversarial suite covers both datetime subclasses and low-level reintroduction of executable timezone behavior.

Current canonical owner

#63 has since advanced by ordinary successors to 08a9cadb888bf363ab55a78cc2cbffb2bcbb9296 over protected develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1 and is deliberately Draft while fresh hosted/review evidence is pending. New #199 is a distinct but adjacent shared-kernel finding: after construction, other governance fields could still be low-level mutated before canonical export. Its repair revalidates one captured evidence snapshot while preserving this issue's exact-UTC fail-closed rule; the first production attempt that accidentally re-froze mutated timezone state was caught by this existing regression and repaired by ordinary successor c088d97f6875b6dfcae03f34229aed6aa4587dd2.

Focused exact-source execution on the corrected audit module and both audit test files reports 55 passed with 100% statement/branch coverage for orgmetra_hris_kernel.audit. Exact-current-head hosted Foundation CI remains pre-checkout, so hosted GREEN and protected integration are not claimed.

Acceptance / closure

Keep this issue open until #63 reaches terminal exact-head hosted evidence, qualifying independent approval, and ordinary protected integration. After #63 integrates, #65 must non-force adopt protected truth before its own merge/release path advances. No administrator bypass, self-approval, force-push, destructive rebase, gate weakening, duplicate mutable dependency, or predecessor-evidence transfer.