fix: keep until-revoked admissions across policy-file revisions

[abrichr]

Why

The docs twin of validateLiveAdmissions fail-closes the same way as openadapt-web. Live admissions keep the v1 policy_sha256. Policy rev 7 has a different file hash. Until-revoked rows then get dropped even though expires_at is JSON null.

Object-ref rows (kind: "qualification-release", no .target) hit the same byTarget.has(admission.target) check. They are the evidence inventory, not a seventh product target.

What changed

Same contract as the web change:

• Don't require issued policy_sha256 to equal the current policy file hash when policy is until_revoked, expires_at is JSON null, the row is not revoked, and the admissions digest still matches the pin.
• Skip object-ref rows. Product Production still needs seven target admissions.
• Fetch the pinned policy and fail closed when it's missing or unparseable.
• Keep fail-closed for digest mismatch, revoked rows, timestamp expiry, and identity drift.

Evidence class stays remote-safe-synthetic. No new unsigned ledger row.

Opened by an agent session, not the founder.