feat: expose hire-to-employment People API

[cursor]

Buyer-visible scope

This lane rebuilds the first post-hire customer-facing People API on the current protected Orgmetra contracts, rather than replaying the historical implementation that predated governed candidate-worker conversion, immutable audit/outbox persistence, and purpose-bound PII authorization.

Protected-base reconciliation

The current default/protected integration base is develop at d531ba0fbb0d1cb70dbaa6b5c6b0431e59cc4c22.

The historical #18 tree carried a legacy tenant schema, mutable audit_event shape, pre-governance candidate-worker link, a competing packages/orgmetra-domain, and duplicated Keyverse/purpose logic. Those artifacts are intentionally not replayed. The rebuilt branch preserves historical ancestry while its active diff stays on current canonical Orgmetra contracts.

Implemented bounded slices

• request-edge bearer-token parsing and authenticated-principal validation fail closed on malformed/ambiguous credentials, reserved UUID sentinels, malformed opaque actor references, mutable/empty scope sets, and wildcard/non-Orgmetra scopes;
• protected field access delegates to the integrated orgmetra_keyverse_adapter contract and authorizes the exact opaque person_record target before protected worker values are retrieved;
• the canonical worker read model preserves candidate-worker conversion, candidate, person, and employment lineage, rejects persistence target escapes, and serializes only policy-authorized fields;
• PostgresPeopleReadPort is now the production read-side adapter: deployment injects the DB connection/pool boundary; the adapter enters an explicit read-only transaction, transaction-locally binds orgmetra.tenant_record_id, uses parameterized fully-qualified SQL, and resolves canonical candidate_worker_conversion_record, person_record, person_name_record, employment_record, and employment_record_version using current recorded-time truth plus the requested business date;
• the PostgreSQL adapter fetches at most two candidate rows and fails closed on duplicate current lineage instead of hiding integrity defects with LIMIT 1; missing workers return None, invalid direct requests fail before a connection is opened, and returned tenant/person identity is revalidated;
• executable regressions cover bearer/principal hardening, exact-target authorization, authorization-before-read, lineage-preserving responses, PostgreSQL tenant/RLS binding, bitemporal predicates, SQL parameterization/object qualification, duplicate-lineage rejection, target-escape rejection, and invalid connection/request boundaries;
• .github/workflows/people-api-quality.yml proves the exact candidate checkout, installs the reviewed SHA256-hashed test toolchain, enforces exact 100% owned statement and branch coverage, and proves a clean checkout;
• a regression now requires People API Quality to dispatch on the repository's current develop integration branch; the workflow was repaired accordingly;
• a second regression found the same stale dispatch boundary in Foundation CI; .github/workflows/foundation-ci.yml now also dispatches on develop without weakening any existing validation or PostgreSQL integrity contract;
• the resulting deterministic-manifest failure was repaired from Foundation CI's own exact printed SHA-256/bytes/lines for the changed workflow, preserving the provenance gate rather than bypassing it;
• the earlier Code Quality unused-import finding remains addressed and its thread is resolved/outdated.

Deliberately not yet claimed

Keep this PR Draft. The tenant-bound production read adapter is complete, but the customer path is not: the HTTP route and atomic accepted-mutation + governed audit/outbox transaction are still outstanding on this canonical branch. The superseded persistence model must not be restored, and no direct cross-service application-table SQL is permitted.

Evidence and governance

Current exact head: 7d7a53d0a6643e558f545095d960a5e05862c4d1. Protected/default integration base: d531ba0fbb0d1cb70dbaa6b5c6b0431e59cc4c22.

Exact-head People API Quality run 32038307062 is terminal GREEN and includes the service's 100% owned statement/branch coverage gate and clean-checkout proof. Exact-head Foundation CI run 32038307119 is terminal GREEN, including Foundation validation and the PostgreSQL integrity matrix. Exact-head Security Scan, SAST Semgrep, Required OpenCode, Required Noema, PR Review Merge Scheduler, and Close Empty PR are also terminal GREEN.

At this update, exact-head Required Strix run 32038305301 and dynamic Code Quality are still in progress and therefore non-passing. There is no qualifying independent approval after the current last push; the only submitted review is historical COMMENTED evidence and its sole thread is resolved/outdated. Predecessor evidence is not transferred.

Remain Draft until the buyer path above is complete and every applicable exact-current-head gate is terminal GREEN. Any current-head failure is a repair trigger. Refetch live rules, reviews, threads, protected base, and exact-head evidence immediately before any ready/merge transition; never bypass protection or self-approve.