Document the hub-authored freeze against the sidecar probe gate

[TheGreatAxios]

CL-7273.

Analysis lane. The ticket's premise — that @corbits/workflow-freeze reimplements the probe gate's freeze and will drift — does not survive reading the imports.

Every step composes a native primitive: projectLiveToInert (@intx/workflow), walkCapabilities (@intx/workflow-deploy), createDefaultDirectorRegistry (@intx/agent), computeWireDefinitionHash (@intx/types), createDbFrozenApprovalWriter (@intx/hub-sessions).

The two that matter are shared with the probe path by identity: workflow-probe-gate.ts:454 calls the same createDbFrozenApprovalWriter, and line 40 imports the same computeWireDefinitionHash it recomputes with at line 233. The hash preimage and the all-or-nothing stamp are one implementation.

What differs is the input (already-inert hub-authored JSON, so no probe round-trip exists) and the approval policy (self-approve, which the probe gate's own comments document as the analogue for live-authored definitions).

The drift test the ticket asked for already exists in substance — index.test.ts pins frozen.wireHash to the native function over the inert projection. A cross-path test would assert a function equals itself.

Recommends closing CL-7273 as 'not a reimplementation'. This package is closer to packages/approvals (cited in CL-7257 as the correct pattern) than to the mintRepoGrant drift.

Docs only. No code change. Draft — not for merge.

[TheGreatAxios]

Consolidated into #531 — four independent docs files merging as one CI cycle rather than four serialized ones under strict branch protection. Content unchanged.