scientific(membership): own stable wire vocabulary for longitudinal design

DDD / release finding

MembershipDesign is the canonical owner-derived classification used by #640, but it previously had no owner-issued stable wire vocabulary. #638/#639 need to bind longitudinal Membership design into an immutable topic-lineage projection. If topic_measurement matches enum variants and invents its own strings, the consumer duplicates Membership-domain semantics and can drift from the owner.

Membership therefore owns a closed, fail-closed wire name for each design variant, analogous to MembershipRole::{wire_name,from_wire_name}, plus an explicit vocabulary version:

vocabulary version tepp.membership_design.v1;
Nested -> nested;
CrossClassified -> cross_classified;
MultipleMembership -> multiple_membership;
CrossClassifiedMultipleMembership -> cross_classified_multiple_membership;
HeterogeneousClassification -> heterogeneous_classification;
HeterogeneousClassificationMultipleMembership -> heterogeneous_classification_multiple_membership.

Unknown names fail closed through MembershipError::UnknownMembershipDesign. This is a serialization boundary only; it does not authorize downstream callers to assert a design label. Consumers must still obtain the enum from Membership-owned classification over canonical state.

RED → repair lineage

Canonical owner PR #605:

source RED 3f044fdcaaa603a4dd059cb89ae78d82b7c7f7a6 requires exact names, round-trip parse, and typed refusal;
owner implementation 37217511ab6c978e3500d652d67f9805a27e7690;
typed UnknownMembershipDesign refusal 09e4320cefe4fb35ec80dadcf7d8c59ff1ca0bb4;
module integration 9cf7ac3d632d76ef0d4b5a8f634a62c90bddde26;
version RED 1c9f1c8b7a1ec0d23efd6f121d7880ea39019017;
vocabulary version 1fad4ef19ba6b1a4f25877687cf4fda9417f00e4;
public export 544cfb9f55087f9f6cdccf55bcde8148fe3b5d28;
CHANGELOG/current exact owner head 3b27cba84f5ceebf0c39c87b9287958656e3a8f1.

No hosted RED/GREEN is claimed yet. Current exact-head required workflows are queued/non-terminal and #605 has no qualifying current-head independent approval.

Acceptance

exact names, round-trip, explicit owner version, and unknown-name refusal are exact-head GREEN;
public rustdoc/error semantics and owned edge coverage are current;
release(contract): publish immutable temporal-analysis contract for Orgmetra consumers #638/fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 consume only the owner-issued vocabulary after normal protected-main landing; no consumer-side string mapping or mutable source copy;
feat(membership): add owner-issued single-membership admission #605 exact-head Rust/rustdoc/coverage/security/CodeQL/Semgrep plus qualifying independent review before protected merge;
issue remains open until downstream/release acceptance is actually satisfied;
no force push, destructive rebase, self-approval, skip/xfail, or gate weakening.