Make the Relay, Notary, and programme decision boundary normative

[jeremi]

Summary

• Makes the source system to Relay to Notary to consuming programme boundary normative across architecture, integration, disclosure, glossary, and Notary guidance.
• Replaces programme-specific eligibility examples with reusable evidence claims, while documenting the narrow source-owned decision exception.
• Reworks the DHIS2 starter into a bounded product-neutral script integration that exposes child-health evidence, plus deterministic offline fixtures for true, false, null, no-match, subject mismatch, and source failure.
• Updates generated authoring catalogs, focused registryctl tests, and the optional live-compatibility conformance profile.

Verification

Passed locally:

• cargo fmt --check
• cargo metadata --locked --format-version 1
• cargo check --locked --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --locked --workspace
• cargo deny check
• npm test (117 tests)
• docs content, markdown, Vale, tutorial dry-run, generation, current build, all archived builds, LLM coverage, and SEO checks
• python3 -m unittest discover -s release/scripts -p test_*.py (200 tests)
• REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
• python3 release/scripts/integration-e2-runner.py validate
• python3 release/scripts/registry-release validate release/manifests/registry-stack-beta-14.yaml
• Notary OpenAPI check and Relay OpenAPI contract check
• git diff --check

After rebasing onto beta-14, the fresh GitHub Docs job passes the complete npm run check, including content, markdown, Vale, tutorial dry-run, generation, current and archived builds, link checking, LLM coverage, and SEO.

GitHub Actions confirms the issue-specific project-authoring portability and determinism jobs pass on x86_64 Linux and aarch64 macOS. DCO, secret scan, CodeQL, Scorecard, and release tooling also pass.

Rebased onto the beta-14 release/1.0 head (817ddec6), which contains the target-base CI repairs identified in the initial run. The fresh build for 19622430 is green: 13 checks passed, 6 path-gated checks were intentionally skipped, and none failed. In particular, Docs, Rust workspace including the Relay OpenAPI baseline comparison, and the source-built Registryctl tutorial all pass.

Security review

• Authorization remains enforced before source work.
• The DHIS2 adapter performs one bounded same-origin request, validates the exact subject selector echoed by the source, and returns only declared typed evidence outputs.
• Credentials remain environment-backed and no raw DHIS2 records enter claims or public release evidence.
• true, false, null, no_match, subject mismatch, and source rejection remain distinct fail-closed semantics. Missing evidence does not become a negative fact.
• No runtime route, authentication, authorization, audit, or cryptographic behavior changes.

Because this change defines security and privacy guidance, Tier-C maintainer review and signoff remain required.

Live compatibility

No public DHIS2 server was contacted. Live compatibility remains an optional, separately governed evidence run; deterministic offline fixtures are the acceptance path.

Closes #417

[jeremi]

Integration status update: the target branch codex/1.0-remaining-integration is now pushed at d377b83a.

The rebased equivalent of this PR's full change is already present in the target branch as a58eab21. GitHub currently reports this draft as conflicting against that advanced base. I am leaving the PR open and draft, with no merge or closure action, so its disposition can be handled explicitly.