scientific(membership): bind canonical observation-support identity to owner classification

Finding

#645 anchors MembershipDesignClassification to observation count and earliest/latest event time, but those coordinates are not unique. Two distinct longitudinal supports can have the same design, cardinality, and time bounds.

That means a valid owner-derived design classification can still be rebound to a different same-shaped cohort/window without an exact owner-side mismatch signal. #638/#639 need reconstructable time/grouping evidence, and a released projection should be able to prove that the Membership design coordinate corresponds to the exact observation support/topology that was classified without publishing raw HR person-level truth.

Required RED

On canonical #605, construct two supports that share:

the same MembershipDesign;
the same observation count;
the same earliest/latest event time;

but differ in at least one opaque member/event-time coordinate while remaining valid under the same Membership network. Their owner-derived support identities must differ.

The same support in a different input order must produce the same identity because Membership classification is order-insensitive. Duplicate coordinates must remain multiplicity-sensitive rather than being silently deduplicated.

Minimal owner repair

Issue a canonical SHA-256 support identity inside MembershipDesignClassification, derived only after canonical Membership classification from:

a versioned domain separator;
the sorted multiset of opaque (MemberId, EventTime) observation coordinates; and
for each coordinate, the sorted active Membership topology observed at that event time: role, group identity, and exact binary64 weight bits.

Use explicit length/count framing. Do not hash caller-provided design labels or caller-provided digest strings. Do not include natural-person identifiers or unrelated HR/application data.

Expose the digest as owner-derived provenance so a later #639 projection can bind its reconstructable, privacy-appropriate support representation to the same classified support.

Boundary

A digest is identity binding, not reconstruction by itself. #639 still needs versioned event-time/window/cohort/observation-support coordinates that a consumer can interpret and mismatch-test. The digest must match that projection; it cannot replace it.

No source copy, mutable cross-repository dependency, numerical-estimator logic, skip/xfail, or privacy expansion is authorized.

Refs #605 #638 #639 #645.