Checks F-G - Final Hardcode / PG-First Native Driven Recheck

Hardcode verdict: HARDCODE_FINAL_NEEDS_FIX

PG-native verdict: PG_NATIVE_FINAL_NEEDS_FIX

Runtime PG-first/native/driven design remains unchanged and accepted: set separation, PostgreSQL ownership/ACL semantics, sealed #20/#21, #11 closure, #26/#27, control epoch, activation state, and evidence-only boundaries remain intact.

Construction-document authority is not yet safely content-addressed. An underspecified aggregate hash, omitted manifest fields, circular self-host full-document hash, or mutable/unpinned checkpoint anchor would leave a disguised mutable-authority path. T1 must close these document-seal defects without adding a runtime surface, readiness gate, #20 column, catalog family, or eighth runtime hash contract.