Signoff Binding Audit

FAIL. Binding table has no PK/FK and one verdict CHECK only. Global safe checks source hash + any SAFE binding + no active NOT_SAFE, ignoring plan ID/version/tier/scope/evidence/authority/actual review verdict. One collection binding can satisfy global count. Directus full DML. Hash survives policy change. Zero bindings today keeps blocked.