scientific(membership): bind owner classification to its longitudinal event-time support #645

Finding

#605 now separates parsed MembershipDesignWire from owner-derived MembershipDesignClassification, but the classification result contains only the design coordinate. It does not retain the observation-support window that was actually classified.

That leaves a provenance ambiguity for #638/#639: a caller can obtain a valid owner-derived classification from support A and later attach its .wire() to a different support B. The type boundary proves that Membership performed a classification, but it does not prove which longitudinal event-time support produced that classification.

This is material because longitudinal Membership semantics are resolved at each (MemberId, EventTime) coordinate. A design label detached from at least the classified support cardinality and event-time bounds can be replayed across a different cohort/window without an owner-side mismatch signal. That would weaken the release requirement that time/window/cohort and multilevel/cross-classified/multiple-membership coordinates remain reconstructable and not be silently discarded.

Required RED

On the canonical #605 owner branch, extend the external authority contract so an owner-derived MembershipDesignClassification exposes, from the exact support that was classified:

• observation count;
• earliest event time; and
• latest event time.

Use an intentionally non-sorted observation input so the owner must derive bounds rather than trust input position. Empty support and missing Membership context must retain the existing fail-closed errors.

A parsed MembershipDesignWire must remain a pure serialization value and must not gain these owner-derived support coordinates.

Minimal repair

Have classify_membership_observations_wire derive the support summary from the same MembershipObservation[] that is passed to the canonical Membership classifier and issue it inside private MembershipDesignClassification state. Do not accept caller-supplied window/count metadata.

This closes event-time-window detachment only. It is not sufficient reconstruction evidence by itself: #639 still needs a versioned, privacy-appropriate observation-support/cohort projection (and, if exact identity binding is required, a canonical owner/consumer digest matched against that projection) before #638 release acceptance.

Boundary

Do not copy HR person-level truth into the released contract. MemberId remains opaque analytical identity. Do not make a design coordinate or digest substitute for reconstructable support evidence. Keep reusable numerical arithmetic in fast-mlsirm and keep this issue within Membership-domain classification/provenance.

Refs #605 #638 #639.