Checks G-H - Final Hardcode / PG-First Native Driven Recheck

Hardcode verdict: HARDCODE_FINAL_NEEDS_FIX

PG-native verdict: PG_NATIVE_FINAL_ACCEPTED

Runtime design remains PG-first/native/driven: authority remains in approved PostgreSQL ownership isolation, sealed #20/#21, #11 closure, #26/#27 where relevant, control epoch, manifest activation, and evidence_registry as evidence only. No name/pattern/owner/CASE/relkind/prokind/source-regex/external-artifact runtime policy was reintroduced.

The remaining disguised-hardcode risk is authoring-time authority: the fixed ACTIVE document registry is authority for implementation authoring but is not sealed/hash-bound. It is therefore a mutable denominator even though it is not a runtime DB surface. T1 must content-address and pin the approved corpus as specified in Check E. No runtime redesign is required.