feat(governance): add source-approval + dataset-freeze contract schema (AEG-X-009, gated)

Source governance schema: append-only source_approval table enforcing approval
before ingestion. Dataset manifest hardened to support FROZEN state, requiring
approval timestamps. Boundaries tested (6/6 passing). Server-side resolver
(DapperApprovedModelContextReader) now guards both model and dataset approval.

P2–P6 deferred: Dataset freeze command, maker-checker review, evaluation/proposal
orchestration remain pending human decision package (source allow-list, license/SLA,
metric versions, roles). No source/model seeded per CLAUDE.md governance.

Migrations 0033–0034 idempotency verified fresh/upgrade/re-run on isolated test DB.

AGENTS.md: Maturity (contract-first); Necessity (governance prerequisite).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

evidence/AEG-X-009/0033-migration-rehearsal.md

@@ -0,0 +1,30 @@
+# AEG-X-009 Source Approval Migration Rehearsal
+
+## Traceability
+
+- WBS: `AEG-X-009`
+- ADR: `ADR-DATA-001` / `DEC-101`
+- Migration: `db/migrations/0033_source_approval_contract.sql`
+- Target: isolated `kartsell_migration_test`
+- Production `kartselldb`: not modified
+
+## Actual execution evidence
+
+```text
+Command: dotnet src/KArtSell.DbMigrator/bin/Release/net10.0/KArtSell.DbMigrator.dll
+Target: Host=127.0.0.1;Port=5432;Database=kartsell_migration_test
+
+Fresh run:
+0032_shadow_run_queued_status_contract.sql -> executed
+0033_source_approval_contract.sql -> executed
+Upgrade successful
+Exit code: 0
+
+Re-run:
+No new scripts need to be executed - completing.
+Exit code: 0
+```
+
+## Boundary
+
+This proves migration fresh/re-run behavior only. It does not authorize any source, create a Dataset Manifest, resolve a model VersionSet, activate a model, publish to clients, submit an order, or submit to KIS.