Reconcile the current-main CMP adoption ledger before upstream sync

Parent/reference: #145 (closed controlled CMP synchronization)
Consumer/related: #290 (static Datamailer source inventory), #50 (Datamailer retirement and Relay purpose wiring)

Product outcome

Restore one truthful, deterministic adoption ledger for the adopted Course Management Platform before any future CMP source synchronization. The ledger must describe the exact reviewed target tree and its intentional target-owned overlays, while keeping the current CMP pin unchanged. A no-op sync against that pin must be an accepted, repeatable proof rather than a blocked or silently regenerated report.

This is a source/adoption-evidence repair. It does not adopt the current CMP main, copy its campaign changes, or authorize any runtime, provider, migration, or deployment behavior.

Evidence boundary

• Website authority for this audit: origin/main face8e4808d65afbf0374d1ced7a88079950d663, tree c8496fb2a37529eb7c63e1eeb9e35e29a2aadada.
• The active shared current-main-derived worktree is redesign-iterations ff30774e9cde310a24abf61229c22cbd5a811186, tree 62e1656881aa7f9de8ab703c14f5a29049c2097d. Its three additional local design edits are identified below; they must not be silently promoted to website main by this issue.
• Website source pin remains CMP 98a235283904b4ef9ad29e196298540756cf1bcc (source-pin.json SHA-256 71145a6b28ed0ea89e984b9c6bda5151549d3597d37c75d4c6b369ef4fbaf1b3). The copied-files ledger SHA-256 is 31a0ef0439b68477b905d9d084bfe9c0998dd8a7168ee3c99bc98d72542ea6e2; the integration-patched-files ledger SHA-256 is db285bab70aef0035235b68e17e63be55e4c133cfe514e0bd9026e2b76ac6c95.
• CMP main was independently audited at 6d3cc0e0e0b9a1d28be1a8d53209555269e1d3fe, tree 45f1f8e2548b25e3ef89d44b2370efbb647ff088, parent e49c575ce3f567cc14a8f66a89d3ccaca3bfe2f4. This issue does not move the website pin to it.
• The current sync dry-run fails closed on the first stale overlay row (accounts/templates/accounts/login.html); it must not be made green by ignoring the ledger or by running --apply.

Exact 15-row mismatch inventory

The current-main-derived audit compared each target overlay byte/size with the recorded integration-patched-files.tsv row. The observed set is exactly these 15 rows. Thirteen rows are already divergent on the authoritative face8e4 tree; the three rows marked redesign-only exist only in the unmerged local ff30774 worktree. The engineer must freeze the final accepted target identity before editing any ledger and preserve that distinction.

Scope

• Freeze one exact website base/tree accepted by the orchestrator; do not infer that the local redesign worktree is main.
• Reconcile only the listed adoption/overlay rows, with a row-level reason and source/target ownership for each.
• Keep the CMP source pin at 98a235283904b4ef9ad29e196298540756cf1bcc and preserve the existing #145 mapping, deletion, migration, and overlay guards.
• Refresh only the necessary versioned adoption evidence and the deterministic report/manifest values required by the chosen target identity.
• Record the exact final target commit/tree, source pin, copied-files digest, patched-files digest, row inventory, and no-op report digest in the engineer/tester handoffs.

Explicit non-goals

• No source-pin update to CMP 6d3cc0e or any other moving ref.
• No sync_course_platform.py --apply, source copy, migration rewrite/squash, runtime behavior, template behavior, API/Studio change, Datamailer/Relay operation, provider/network call, protected-data access, CI rerun, commit, push, merge, or deployment in this issue.
• Do not absorb the three unmerged redesign-only rows into origin/main or overwrite user work.
• Do not use this issue to decide or implement EmailCampaign/campaign queue/from_email behavior; that is the separate decision issue linked from #50.

Dependencies and ownership

• #145 is the completed synchronization procedure and guard authority; do not reopen it.
• #290 consumes a truthful adoption ledger and must not be accepted from the stale face8e4 evidence until this reconciliation is complete.
• #50 consumes #290's later source inventory but owns no ledger rewrite here.
• The future CMP campaign decision is intentionally separate from this evidence repair and from #149's four system-evaluation/peer-task/score/notification behavior packets.

Acceptance criteria

• PM records and freezes one exact target commit/tree; the 15-row inventory is reclassified against that identity, with every row accounted for exactly once and no local-only edit silently promoted.
• The adoption manifests record the actual target-owned overlay bytes for every intentional row, retain the pinned CMP source bytes/provenance, and contain no unreviewed path, duplicate, omission, or migration replacement.
• uv run --frozen python scripts/verify_course_platform_adoption.py passes against a clean checkout at CMP 98a235283904b4ef9ad29e196298540756cf1bcc.
• A fresh no-op uv run --frozen python scripts/sync_course_platform.py --source-ref 98a235283904b4ef9ad29e196298540756cf1bcc --source-checkout <clean-checkout> --report <redacted-report> --dry-run returns status=no_change, records the exact pinned/requested SHA, and reports zero changed, copy, conflict, and fatal paths without mutating tracked files.
• make migrations-check, adoption-focused tests, format/lint/type checks, and the verification plan selected for the changed evidence pass; the report classifies every component exactly once and documents screenshots as not applicable only if the graph proves no render inputs changed.
• Independent tester recomputes the plan from the frozen target identity, verifies the manifest/no-op report and every acceptance criterion, and posts a tester-final report before PM acceptance.
• PM posts ACCEPT only after the independent tester pass; the eventual focused commit uses Refs #297 and the orchestrator performs the normal local no-ff merge/push lifecycle.

Browser/test scenarios

This is non-rendering evidence work, so product screenshots are not applicable when the recomputed plan proves render inputs unchanged. The tester still runs the graph-selected repository-local tier and checks that the no-op sync/verifier cannot alter a rendered route. No provider, external CMP operation, or production browser session is permitted.

1. Run the no-op sync twice against a clean checkout of the pinned CMP commit; both reports and all tracked target bytes are identical.
2. Introduce a synthetic stale row, missing row, duplicate, wrong hash/size, source-pin drift, or dirty source checkout in an isolated fixture; the verifier fails closed with a bounded reason and no target mutation.
3. Confirm the final adopted course and account route manifests remain navigable/read-only under the existing target identity; no campaign or Relay behavior is exercised.

Required lifecycle

The candidate remains uncommitted after engineering. The independent tester must capture exact base/head/tree and report/artifact digests, then PM accepts or returns it. No source sync, deployment, or upstream CMP adoption is implied by a green no-op.

Start by reading scripts/verify_course_platform_adoption.py and scripts/sync_course_platform.py, then freeze the accepted website commit/tree rather than using the redesign worktree. Reconcile the listed adoption rows and refresh only the required evidence. Done means verification passes and two dry runs against the pinned CMP commit return identical status=no_change reports without changing tracked files.