fix(audit): validate and detach exact UUID payload in canonical envelopes #278

Finding

While repairing Job Analysis nested UUID payload integrity on #63/#277, the same invariant was verified in manifest-sealed packages/hris-kernel/src/orgmetra_hris_kernel/audit.py: _validate_event_snapshot(...) proved exact outer UUID type but compared .int against nil/max before proving the nested scalar was an exact built-in int, and AuditOutboxEvent.__new__ retained caller UUID objects directly.

An exact UUID can be low-level forged with object.__setattr__(value, "int", attacker_object), so executable equality could run during sentinel checks. A valid caller-owned UUID could also be low-level mutated after construction and change tuple-held CloudEvent identity through the caller alias.

Implemented on canonical owner #63

• Test-first c423de6205fd22f654d4602cc4eab54295709515 adds focused audit regressions for executable/non-int nested UUID payloads, out-of-range exact integers, and post-construction caller-alias mutation.
• Causal source repair afd47f07408f03048f9cac89ee60e2b03614615f captures .int once, requires an exact built-in int, validates the 128-bit range before nil/max equality, and reconstructs owned UUID(int=identity) values for event and tenant identity before tuple storage.
• Exact afd47f... Foundation run 34293586152 then produced a real RED at foundation-pack validation because manifest-sealed audit.py had changed while manifest.json still described predecessor bytes.
• Ordinary-forward d88800a5ca3ca15df332e8def5e25064c46e4005 reseals the existing canonical audit.py inventory entry to SHA-256 f7e1d56073bdabcd7051f9757c17b9f009d9384a6bad07cf4ef9c936f2ff7876, 12,950 bytes, 314 lines. It does not expand the manifest path set.
• Exact-head Foundation 34294884750, Security 34294884604, SAST 34294884676, Required OpenCode 34294885141, merge scheduler 34294884932, and dynamic Code Quality 34294883368 are terminal SUCCESS on d88800a5.... CodeQL 34294884616, Noema 34294884955, and Strix 34294884985 remain nonterminal at this authority update; predecessor verdicts are not transferred.

Acceptance

• Exact-UUID executable/non-int payload is rejected with ValueError before attacker equality or coercion executes.
• Exact built-in integer payload is captured once, range/nil/max validated, and reconstructed into owned event/tenant UUID values before tuple storage.
• Caller UUID alias mutation after construction does not change event_id, orgmetratenant, canonical JSON or digest.
• Low-level forged tuple export remains fail-closed; exact outer type, timezone detachment, PII minimization and high-impact confirmation invariants remain intact.
• Focused owned tests and exact manifest reseal remain GREEN under current-head Foundation 100% statement/branch coverage plus required security/review workflows.
• fix(core): protect canonical evidence runtime types #63 remains the canonical shared HRIS-kernel owner; no Workforce Validation source copy. docs/product-technical-gap-baseline.md stays docs: maintain durable product-technical gap baseline #100 single-writer.

Keep this issue open until the exact audit delta/tests/manifest evidence reach protected develop through normal merge, or a verified successor completely inherits them. No simple Close on branch-local GREEN.