Separate green tests from a defensible release decision

Repair release-evidence.sql. Return the six named columns once per distinct candidates row; release_id is unique except exact imported copies. Integer flags are 0/1. Every check is evaluated at that candidate's deploy_at. Evidence is current when deploy_at-20 <= observed_at <= deploy_at. Authority and waiver intervals use from_at <= deploy_at < until_at. Build provenance needs a verified current exact-digest observation from a builder authorized at deployment, matching source_revision. Any verified current authorized observation of another source revision for that digest makes provenance conflicting. Use every obligation for the candidate's service; an empty obligation set is unknown, never passing. For each exact-digest control, the latest current test timestamp must exist and ALL records tied at that timestamp must be PASS. Earlier passes, future results, unrelated controls and other digests cannot repair a missing, failed or conflicting latest result. tests_ok is raw complete coverage without exceptions. exceptions_ok means every unmet obligation has an admissible waiver (or no obligation is unmet). A waiver needs waivable=1, exact release/digest/control, nonempty rationale, approver different from author, current evidence_at and live waiver plus exact service/control/person delegation. Nonwaivable gaps remain blocked. rollback_ok needs a known nonnegative candidate rollback_budget and an independent verified same-service rollback package DIFFERENT from the candidate digest, available by deployment, whose inclusive schema range contains db_schema and whose nonnegative restore_minutes fits rollback_budget. Disposition is BLOCKED unless provenance_ok, exceptions_ok and rollback_ok all hold. Otherwise use READY when tests_ok=1 or READY_WITH_EXCEPTION when tests_ok=0. Preserve exact copies once and missing/NULL/unknown evidence as false. Source-only records do not expand the candidate population.