Keep orthophoto release evidence immutable

docs/CODEX_EXECUTION_LOG.md

@@ -9787,6 +9787,8 @@ Implemented:
 - Made the latest official `YYYY.NN` Dataset authoritative for source-catalog
   comparison even when a newer-imported rolling marker also exists. No API,
   migration, release table, Job type or frontend behavior changed.
+- Made stage, review and applied evidence write-once. Exact apply retries reuse
+  the original checksum-bound evidence and never rewrite approval history.
 
 Validation so far:
 - 38 focused Sprint 222/230/231 tests pass with deprecations treated as errors.

docs/STORAGE_ARCHITECTURE.md

@@ -168,7 +168,9 @@ flight-day preflight identities; review binds a named approval; applied
 evidence binds both to the immutable Dataset id and checksum. Paths outside
 this root, changed files and changed provider/local state fail closed. Only the
 normalized GeoTIFF enters ordinary Dataset storage through DatasetService.
-Existing `most_recent_at_*` raster metadata is never rewritten.
+Existing release evidence and `most_recent_at_*` raster metadata are never
+rewritten. An exact apply retry validates and returns the original applied
+evidence rather than replacing it.
 
 DHMV II DTM/DSM outputs are also normal raster Dataset files. The provider WCS
 returns multipart coverage data; GeoIntel retains response and extracted