v0.2-M6: corpus cutover and legacy-loader removal behind parity

[luofang34]

Parent epic: #157. Design anchor: DD-2 and the parity/bundle contract in DD-15.

Objective

Make the corpus graph the sole certification baseline without losing Evidence self-trace, floors, reports, approval enforcement, bundle integrity, or deterministic behavior.

Completed foundation

• Matrix is graph-derived at legacy parity (v0.2-M1: derive trace matrix from CorpusGraph at exact parity #171 / feat(corpus): derive trace matrix from canonical graph #175).
• Floors are graph-derived at legacy parity (v0.2-M1: derive trace floors from CorpusGraph at exact parity #172 / feat(corpus): derive trace floors from canonical graph #176).
• Assurance bijections are graph-derived at legacy parity (v0.2-M1: derive assurance bijections from CorpusGraph at exact parity #173 / feat(corpus): derive assurance bijections from canonical graph #177).
• Requirement gap reports are graph-derived at legacy parity (v0.2-M1: derive trace gap reports from CorpusGraph at exact parity #174 / feat(corpus): derive requirement gap reports from canonical graph #178).
• Lifecycle, digest-bound review, strict approval validator, and proposal authority boundary are implemented in M2 (v0.2-M2: requirement lifecycle, digest-bound review, and proposal boundary #165).

Remaining M6 scope

• Derive any remaining context and coverage views from the canonical graph and prove output parity.
• Bind corpus index files, source records, structural source graph, requirements, reviews, proposals selected for audit, and sources.lock into bundle integrity verification.
• Make validate_approval_boundary(..., LifecycleEnforcement::Required) mandatory for native cert/record claims; an exported but uncalled validator is not enforcement.
• Make corpus-relevant source, review, approval, profile, and lock changes visible in diff/completeness results.
• Migrate this repository certification data to the corpus layout.
• Preserve crate-root and command APIs unless an independently reviewed breaking change is explicit.
• Prove exact parity for UIDs, human IDs, edge sets, selectors, floors, diagnostics, reports, check/context outputs, and deterministic artifacts.
• Remove the legacy loader and compatibility projection only in the change guarded by the full parity suite.
• Keep golden and determinism changes explicit and reviewed.

Dependencies and release gate

• M1 through M5 must be complete.
• The v0.1.6 Assurance correctness milestone is complete.
• Define recipe identity and reproduced-output comparison semantics #139 supplies canonical recipe/input/output identity for corpus reproducibility comparisons.
• init must produce a schema-valid, doctor-complete, non-fake scaffold #142 supplies schema-valid, adoption-honest initialization.
• Cert and record generation must be locked and offline without network fallback #143 supplies locked/offline cert, record, and external-ingester execution.
• Bundle diff and completeness status omit material assurance changes #144 supplies category-complete diff and derived completeness states.
• M6 must integrate these established contracts rather than introduce parallel semantics.

Milestone boundaries

M6 owns bundle binding, mandatory cert/record enforcement, repository migration, parity, and deletion. Source acquisition, ingestion, extraction semantics, and new public command families remain in their owning milestones.

Delivery discipline

This is a milestone tracker. Remaining derived views, bundle integration, approval wiring, corpus-aware diff/completeness, repository migration, and final deletion use dedicated child issues and independently revertible PRs.

Done when

There is one corpus source of truth; native cert/record claims cannot consume unapproved requirements; every corpus baseline artifact is integrity-bound and visibly comparable; all guardrails retain equivalent or stronger meaning; and no legacy loader or dual-write path remains.