Deterministic, content-addressed baseline lockfiles.
The baseline records an accepted canonical execution surface. It contains no policy and no candidate-vs-baseline diff semantics.