scientific(membership): publish privacy-reduced reconstructable longitudinal support wire #649

Finding

#646 binds MembershipDesignClassification to an exact owner-side SHA-256 over opaque (MemberId, EventTime) support plus active Membership topology. That closes same-shaped support aliasing, but the digest is intentionally not reconstruction evidence. #638/#639 still need a consumer-interpretable, versioned representation of the longitudinal event-time/grouping structure without copying raw HR/person-level truth into the release contract.

If Analysis invents that representation after #605 lands, it must re-map Membership roles/groups/weights and support ordering itself. That would duplicate Membership-domain semantics and create another place where cross-classified/multiple-membership structure can be flattened or reordered inconsistently.

Required RED

On canonical #605, require an owner-issued reconstructable support projection that:

• is derived only after canonical Membership admission/classification at each observation's own EventTime;
• emits no raw MemberId or GroupId UUID text;
• preserves repeated-member linkage, repeated observations, event times, role, group linkage, and exact binary64 membership-weight bits through projection-local ordinals;
• is deterministic under observation input reordering and active-assignment insertion reordering;
• preserves duplicate observation multiplicity;
• has a versioned canonical JSON form whose parser rejects unknown fields, unsupported versions, non-canonical ordering, non-canonical event-time spellings, non-contiguous/local-ordinal misuse, malformed weight bits, and byte-noncanonical JSON; and
• binds the exact owner-side support digest from scientific(membership): bind canonical observation-support identity to owner classification #646 so released consumers can distinguish structural reconstruction from source-identity provenance.

Use fixed opaque UUID fixtures and prove their textual UUIDs are absent from the released projection bytes.

Minimal owner repair

Introduce a Membership-owned wire/projection type rather than exposing mutable source structures. Local member/group ordinals may be derived from canonical opaque-ID ordering, but the released bytes must contain only those local ordinals, canonical UTC event times, role wire names, and exact f64 weight bits. Treat this as privacy reduction/purpose scoping, not anonymity.

Parsed wire values are non-authoritative serialization data. Canonical owner-issued projection authority must remain distinct and originate from Membership-owned state, preserving the authority separation established in #644.

Boundary

This issue does not authorize Analysis to copy Membership source, publish natural-person identifiers, infer HR identity, change estimator arithmetic, or treat the projection as employment/validity authority. The owner support digest remains provenance identity; the reconstructable wire preserves scientific grouping/time structure. #639 should consume the released owner contract only after #605 lands normally on protected main.

Refs #605 #638 #639 #644 #645 #646.