membership: allow non-overlapping re-entry for the same member/group/role identity #606

Finding

MembershipNetwork::insert currently indexes only (member_id, group_id, role) and therefore rejects every later assignment with the same identity, even when the event-time validity intervals are strictly disjoint. This contradicts the membership model's own time-varying contract and prevents a member from leaving and later re-entering the same group/role.

This is scientifically material for longitudinal composition: a caller cannot represent repeated organizational/community membership spells without either changing identity artificially or flattening event-time history. The new single-membership admission in #605 would inherit the same defect because admit_single_membership reads MembershipNetwork state.

Public RED

On the #605 single-writer branch, add a repository-owned contract showing that two assignments with the same (member, group, role) but disjoint closed validity intervals must both be accepted, must admit at their respective event times, and must be inactive in the gap. The current implementation should fail on the second insert.

Also preserve fail-closed behavior for overlapping or endpoint-touching closed intervals of the same identity; because membership validity uses included bounds, two intervals that share an endpoint are simultaneously active at that instant and must not both be admitted.

Causal repair

Repair MembershipNetwork::insert so assignment identity and temporal overlap are considered together. Do not relax cross-group/cross-role multiple-membership preservation and do not rewrite event-time history. Keep exact duplicate/overlapping same-identity inserts rejected; allow only strictly disjoint repeated spells.

Acceptance

• realistic RED on the current feat(membership): add owner-issued single-membership admission #605 lineage before production repair;
• disjoint same-identity re-entry accepted and queryable at both periods;
• gap remains inactive;
• overlapping and touching closed intervals fail closed;
• existing simultaneous group/role membership behavior is unchanged;
• exact-head Rust/rustdoc/tests/coverage/security/CodeQL/Semgrep and independent current-head review before protected-main landing;
• ordinary-forward only; no force push, destructive rebase, skip/xfail, or gate weakening.

This issue is a Membership bounded-context repair prerequisite for #604; it does not broaden the CWC estimand.