scientific(membership): distinguish parsed wire coordinates from owner-derived classification authority #644

Finding

MembershipDesignWire::parse(version, name) and classify_membership_observations_wire(network, observations) currently return the same public MembershipDesignWire type. The documentation says parsing is non-authoritative and owner classification is authoritative, but the type system does not preserve that boundary: any caller can parse a supported pair such as {tepp.membership_design.v1,nested} and obtain a value indistinguishable from one issued from canonical Membership state.

This is a DDD/authority defect, not a vocabulary defect. Released consumers need to deserialize wire coordinates, but a parsed coordinate must not be representable as canonical owner-derived classification evidence without reclassification against Membership state.

Required repair

• keep MembershipDesignWire as the stable deserialization/serialization value object;
• introduce a distinct Membership-owned classification result type issued only by classify_membership_observations_wire (or equivalent canonical owner path);
• expose the underlying wire coordinate for released projection only from that classification result;
• preserve typed fail-closed behavior for empty/missing observation support and unsupported wire inputs;
• do not add consumer-local authority flags, source copies, or cryptographic claims that Membership does not own.

Acceptance

A caller that only has {version,name} can parse a MembershipDesignWire but cannot construct the owner-derived classification-result type. Canonical longitudinal classification returns the distinct owner result, and tests prove both paths remain intentionally non-interchangeable at the public API boundary.