perf(people): bind separation support references to canonical token_urlsafe output #391

Finding

Fresh audit of Draft #317 against canonical People #64 found one remaining response-envelope false-GREEN in tests/performance/employment_separation_response_contract.mjs.

The active People owner generates every client-visible support_reference through _send_error() with _SUPPORT_REFERENCE_RANDOM_BYTES = 24 and token_urlsafe(24). Python secrets.token_urlsafe() URL-safe-base64-encodes the requested random bytes and strips padding; 24 bytes are exactly 32 base64url characters because 24 is divisible by 3. Canonical #64 therefore emits err_ plus exactly 32 [A-Za-z0-9_-] characters.

The current performance consumer accepts ^err_[A-Za-z0-9_-]{20,80}$. A governed-looking 409 response can therefore pass commercial response validation with a 20-, 24-, 31-, 33-, or 80-character suffix that canonical #64 cannot emit. This is evidence-contract drift, not an HR-domain change.

Required repair

• Test first with a canonical 32-character suffix and at least one currently accepted non-canonical length.
• Narrow only the response-side support-reference representation to err_ plus exactly 32 base64url characters.
• Preserve the closed ErrorResponse envelope, exact separation_conflict code, message/next-action bounds, strict duplicate-aware JSON parsing, media-type checks, and perf(people): bound governed response JSON before strict parsing #389/perf(people): align response recorded_at precision with canonical People serializer #390 response budgets/timestamp rules.
• Do not change canonical People source/OpenAPI from the performance lane.
• Keep this issue open through protected/integration acceptance; branch-local repair alone is not completion.

Owner: Draft #317 (perf/employment-separation-buyer-path).