scientific(membership): prevent caller-issued design coordinates at the owner boundary #643

Finding

Fresh review of #642 found that MembershipDesignWire::from_design is public while MembershipDesign itself has public variants. That means a downstream caller can construct MembershipDesign::Nested and mint what looks like an owner-issued wire coordinate without Membership ever classifying canonical network state.

The rustdoc says the coordinate should be owner-derived, but the API does not enforce that invariant. For #638/#639 this would turn a serialization VO into a caller-authorized scientific classification boundary.

Required repair

• make raw design→wire construction crate-private;
• expose a narrow Membership-owned function for longitudinal support that calls classify_membership_observations(network, observations) and returns MembershipDesignWire only from that result;
• keep public MembershipDesignWire::parse(version, name) as an interpretation/deserialization boundary only, explicitly not scientific authority;
• do not copy network state or classification semantics into fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639.

Acceptance

• source RED requires a public owner-derived longitudinal wire-coordinate API absent from the current head;
• valid canonical observation support returns the same design/version/name that Membership classification derives;
• missing observation membership continues to fail closed through the wire-coordinate API;
• external callers no longer have a public raw from_design constructor;
• rustdoc/export/CHANGELOG and release(contract): publish immutable temporal-analysis contract for Orgmetra consumers #638/fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 handoff are current;
• hosted exact-head gates + independent review before protected merge.