feat: reject bitemporal organization hierarchy cycles

[cursor]

Reconciled canonical scope

Protected bootstrap now includes the canonical foundation plus employment-status recovery work. This branch preserves only the non-duplicated organization-hierarchy invariant from the former divergent history: an authoritative organization hierarchy must remain acyclic at the exact tenant, effective-day, and recorded-knowledge coordinate being reconstructed.

Exact current head is cc0cddcf867de6db065d3998cd0dec93fe247d2c, reconciled with protected bootstrap by a non-force merge commit so the current base is an ancestor of the branch.

Test-first repair

• The lane retains the RED indirect A→B→C→A regression before production support existed.
• OrganizationUnitVersion plus validate_organization_hierarchy(...) live in the canonical packages/hris-kernel boundary rather than a competing domain package.
• Each unit resolves through the existing single-valued bitemporal resolver before graph traversal, so simultaneously visible competing versions fail closed.
• Cycle detection is tenant-scoped and evaluated at the requested effective day and knowledge cutoff; future-recorded facts and another tenant cannot contaminate the result.
• A cycle returns an operator-readable next action to close or correct the superseded parent link.

Exact-head evidence boundary

Foundation CI, SAST, Security Scan, Required OpenCode Review, Required Noema Review, Required PR Review Merge Scheduler, Close Empty PR, and Strix Security Scan have produced terminal success for exact head cc0cddcf867de6db065d3998cd0dec93fe247d2c. Predecessor evidence does not transfer if the head moves.

Live merge governance

The freshly refetched protected-branch rules require all seven organization workflows, one approving review, approval after the last push, and resolution of all review threads. There are currently no submitted reviews and no review threads on this PR. This automation must not self-approve or bypass protection.

The PR is now ready for review because its exact-head required checks are terminal GREEN and protected bootstrap remains e241793d2b0784c6f2ea8f226a9fa0d4b925f573. Merge only after a qualifying independent non-author approval lands on the unchanged latest head and a fresh gate sweep still proves the base/head/rules/checks/threads unchanged.

Customer next action

A qualifying independent reviewer should review exact head cc0cddcf867de6db065d3998cd0dec93fe247d2c. After approval, refetch every live gate and merge only with expected-head protection if the same head still satisfies all requirements.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.