feat(governance): add source-approval + dataset-freeze contract schema (AEG-X-009, gated)

Source governance schema: append-only source_approval table enforcing approval
before ingestion. Dataset manifest hardened to support FROZEN state, requiring
approval timestamps. Boundaries tested (6/6 passing). Server-side resolver
(DapperApprovedModelContextReader) now guards both model and dataset approval.

P2–P6 deferred: Dataset freeze command, maker-checker review, evaluation/proposal
orchestration remain pending human decision package (source allow-list, license/SLA,
metric versions, roles). No source/model seeded per CLAUDE.md governance.

Migrations 0033–0034 idempotency verified fresh/upgrade/re-run on isolated test DB.

AGENTS.md: Maturity (contract-first); Necessity (governance prerequisite).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

evidence/AEG-X-009/0034-dataset-freeze-rehearsal.md

@@ -0,0 +1,24 @@
+# AEG-X-009 Dataset Freeze Contract Rehearsal
+
+## Traceability
+
+- WBS: `AEG-X-009`
+- ADR: `ADR-DATA-001` / `DEC-101`
+- Migration: `db/migrations/0034_dataset_manifest_freeze_contract.sql`
+- Target: isolated `kartsell_migration_test`
+- Production `kartselldb`: not modified
+
+## Actual execution evidence
+
+```text
+DbMigrator upgrade: 0034_dataset_manifest_freeze_contract.sql executed, exit code 0
+DbMigrator re-run: No new scripts need to be executed, exit code 0
+Journal: 0034_dataset_manifest_freeze_contract.sql present
+Status constraint: PROPOSED, APPROVED, FROZEN, QUARANTINED, RETIRED
+Frozen approval constraint: FROZEN requires approved_by, approved_at, frozen_at
+Append-only trigger: dataset_manifest_no_update present
+```
+
+## Boundary
+
+This rehearsal validates schema and migration behavior only. No dataset row was seeded, no source was authorized, no VersionSet was resolved, and no model evaluation or Shadow Run was started.