Governance: enforce one-member voting authority and revocation lifecycle (TRR-03, TRR-05, TRR-22)

[NeaBouli]

Parent audit register: #303
Related future ballot epic: #232
Rollout tracker: #29

Objective

Close the current one-member-many-keys and stale-authority paths without silently destroying anonymity. This is a current permission-register and reward-integrity problem, not an implementation of the deferred ballot engine.

Acceptance criteria

• Approve a versioned rule for active permission keys and identity commitments per member.
• Remove the direct onboarding bypass or make AnyoneCanJoin and admin approval semantics explicit and enforced.
• Prevent one member from obtaining multiple votes or multiple RateToEarn payouts for one suggestion through multiple keys or commitments.
• Revoke or invalidate voting authority when membership is removed, with an explicit privacy-preserving design.
• Confirm and test Big Purge re-registration and re-vote semantics.
• Add replay, rotation, exclusion, purge, payout and export/import tests.
• Keep Governance: implement the domain-configurable ballot engine after rollout stabilization #232 deferred; link only the approved invariants needed by its later ballot stages.

Safety boundary

No new ballot engine, production identity, ceremony, migration or rollout credit.