Add governed orthophoto release promotion

docs/STORAGE_ARCHITECTURE.md

@@ -148,12 +148,27 @@ in source/provenance metadata. Browser PNG rendering is derived on request and
 does not replace the stored GeoTIFF.
 
 The orthophoto release preflight writes no source file, raster or database row.
-Its JSON stdout may be retained by an operator as review evidence, but it is
-not itself staging authorization. The report binds official WMS and WCS XML
-hashes, the exact selected domain and hashed flight-day sample evidence. A
-future pixel stage must persist and revalidate that identity separately before
-DatasetService is called; existing `most_recent_at_*` raster metadata is not
-silently rewritten.
+Its JSON stdout is not staging authorization. Governed release evidence is
+retained separately per scope, official edition and exact selection hash:
+
+```text
+storage/operator-evidence/orthophoto-release/{scope}/{YYYY.NN}/{selection-hash}/
+  official-wms-response.tif
+  orthophoto_{YYYY.NN}_{selection-hash}.tif
+  review-preview.png
+  staged-manifest.json
+  staged-plan.json
+  review-evidence.json
+  applied-evidence.json
+```
+
+The manifest binds the one bounded source response, normalized three-band
+EPSG:31370 GeoTIFF and PNG preview. The plan also binds WMS/WCS/catalog and
+flight-day preflight identities; review binds a named approval; applied
+evidence binds both to the immutable Dataset id and checksum. Paths outside
+this root, changed files and changed provider/local state fail closed. Only the
+normalized GeoTIFF enters ordinary Dataset storage through DatasetService.
+Existing `most_recent_at_*` raster metadata is never rewritten.
 
 DHMV II DTM/DSM outputs are also normal raster Dataset files. The provider WCS
 returns multipart coverage data; GeoIntel retains response and extracted