feat(governance): add source-approval + dataset-freeze contract schema (AEG-X-009, gated)

Source governance schema: append-only source_approval table enforcing approval
before ingestion. Dataset manifest hardened to support FROZEN state, requiring
approval timestamps. Boundaries tested (6/6 passing). Server-side resolver
(DapperApprovedModelContextReader) now guards both model and dataset approval.

P2–P6 deferred: Dataset freeze command, maker-checker review, evaluation/proposal
orchestration remain pending human decision package (source allow-list, license/SLA,
metric versions, roles). No source/model seeded per CLAUDE.md governance.

Migrations 0033–0034 idempotency verified fresh/upgrade/re-run on isolated test DB.

AGENTS.md: Maturity (contract-first); Necessity (governance prerequisite).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

db/migrations/0034_dataset_manifest_freeze_contract.sql

@@ -0,0 +1,32 @@
+-- AEG-X-009 / ADR-DATA-001: make dataset freeze explicit and append-only.
+-- This migration does not create or seed a dataset. It only hardens the existing
+-- evaluation.dataset_manifest boundary.
+
+alter table evaluation.dataset_manifest
+    drop constraint if exists dataset_manifest_status_check;
+
+alter table evaluation.dataset_manifest
+    add constraint dataset_manifest_status_check
+    check (status in ('PROPOSED', 'APPROVED', 'FROZEN', 'QUARANTINED', 'RETIRED'));
+
+alter table evaluation.dataset_manifest
+    drop constraint if exists dataset_manifest_frozen_approval_check;
+
+alter table evaluation.dataset_manifest
+    add constraint dataset_manifest_frozen_approval_check
+    check (
+        status <> 'FROZEN'
+        or (approved_by is not null and approved_at is not null and frozen_at is not null)
+    );
+
+create or replace function evaluation.reject_dataset_manifest_mutation()
+returns trigger as $$
+begin
+    raise exception 'evaluation.dataset_manifest is append-only; create a correction record';
+end;
+$$ language plpgsql;
+
+drop trigger if exists dataset_manifest_no_update on evaluation.dataset_manifest;
+create trigger dataset_manifest_no_update
+before update or delete on evaluation.dataset_manifest
+for each row execute function evaluation.reject_dataset_manifest_mutation();