Bug: folded ledger binding lacks qualified scope

[lamemustafa]

Bug and root cause

The shared binder can return a resolved ledger from a symmetric folded-name comparison even though the catalogue carries no product/release/licence qualification. This is the implementation mismatch identified in #314, following the binder introduced by #288. Runtime admission establishes product/mode but does not constrain the catalogue to the measured Silver scope. Copying the returned live spelling into a later exact-name import check does not repair a wrong source-to-master choice.

Rectification and acceptance

• Keep byte-exact and separately justified identifier-first matching intact.
• A folded-name match without the required qualification remains an explicit candidate and does not authorize automatic resolution. Preserve useful candidates rather than silently dropping them.
• Cover both public consumers: source-draft catalogue binding and agent master validation/import preparation.
• Update ADR 0016 and the protocol/implementation references to agree on the distinction between measured gateway behavior, suggestion and binding authority.
• Regression controls must show an unqualified folded name cannot become Bound while exact names and identifier-first decisions retain their existing behavior. Do not manufacture new live qualification or broaden a measured comparison direction.

Track the correction in a Rectify PR with source/reproduction evidence, compatibility reseal, rollback notes and current-commit review. #314's corresponding P1 stays open until the implementation is corrected and verified. This issue does not authorize new live Tally writes.