FIX7 Canonical Hash Spec

PG16+pgcrypto required, absent => NO-GO/operator Level-B install. Canonical explicit-key JSONB, ordered arrays, UTF8, domain separation, digest SHA-256; JSON null differs from string NULL; no floats/unordered/omitted unknown/delimiter/MD5. Seven exact contracts: readiness_manifest_hash, dependency_manifest_hash, capability_evidence_hash, signoff_binding_hash, activation_hash, plan_content_hash, control_state_hash. Exact payload key maps/order rules and mutation/delete/add/reorder/null/signoff sensitivity tests are specified; missing/extra/NULL/unknown fails.