Milestone 5 slice 2: trainee packets over the export units

[TusanHomichi]

Problem or outcome

#46 made finalized versions leave the installation as verifiable export units (ADR 0014). A trainee leaving with their records needs more than the versions: #44 decision 3 settled that a trainee packet is everything retained about one enrollment — every retained version of every record, superseded originals included, the acknowledgments, the amendment records, the task signoff history, and one packet manifest — with nothing summarized-only. This slice delivers that packet as one archive built on the same units, verifiable with the same verifier.

Scope

In scope:

• A packet format (consolebook-trainee-packet, version 1): a ZIP archive whose root manifest.json is the packet manifest — installation identity, export instant, the enrollment and its trainee as presented at export, the unit list exactly as the record export lists it, and a documents list naming each further document with its SHA-256. Units are byte-identical to record-export units.
• Packet documents as canonical JSON with typed shapes: packet/enrollment.json (program version, trainee presentation as of export, enrollment lifecycle and phase history), packet/acknowledgments.json (every acknowledgment of every version, from the stored snapshots), packet/amendments.json (every amendment with its predecessor and successor identity), packet/signoffs.json (the full task signoff history with competency and task text). A documented place for rendered PDFs, which arrive with slice 4 and a format-version bump.
• Authorization as a typed contract: the trainee on their own enrollment (view_own_records), whoever may read the enrollment's training history, and export_records holders. An enrollment with no finalized version still produces a packet (its history is the truth); an unknown enrollment is refused.
• Verification from the packet alone: the existing verifier learns the packet format — the same unit checks, plus documents present with matching hashes, canonical and typed, references from acknowledgments and amendments resolving to listed units, every unit's envelope naming the packet's trainee, and nothing unlisted.
• Audit (trainee_packet_exported), GET /api/enrollments/{id}/packet, a list of the trainee's own enrollments for the My records page, web controls on the enrollment page and My records, docs/formats/trainee-packet.md, ADR 0015, a domain-model entry.

Out of scope:

• PDFs (slice 4), retention and disposition (slice 3), streaming the archive body (Stream installation exports instead of assembling the archive in memory #47).
• Training sessions and drafts: sessions a record covered are inside that record's bytes; sessions and drafts without a finalized version are operational data, not records.
• A trainee web view of their own signoff history outside the packet (raised separately).

Acceptance criteria

• A packet's units equal the record export's units byte for byte, and every retained version of every record of the enrollment is present.
• Each document's contents equal the stored rows (snapshots, not live joins, wherever a snapshot exists) and its hash in the manifest matches its bytes.
• The same enrollment packed at the same instant is byte-identical.
• export verify reports a packet's units, documents, and references; a tampered document, a missing document, an unlisted entry, a dangling acknowledgment reference, and a unit from another trainee each produce a named finding.
• Authorization is typed and tested: own enrollment, training-history readers, and export_records succeed; another trainee and an unassigned trainer are refused.
• Web: the enrollment page and the trainee's My records page offer the download; the e2e proof downloads a packet as the trainee and verifies it with the CLI.
• Every packet export is audited without content.

Expected proof

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (new tests/trainee_packet.rs)
• web/: npm run check, npm run build, npm run e2e

Related roadmap, decisions, or issues

• Refs Milestone 5 design: exports and recovery #44 (Milestone 5 design; decision 3 and slice plan item 2)
• Builds on Milestone 5 slice 1: structured record exports and the export format #45/records(export): structured record exports and the export format #46 and ADR 0014; ADR 0013 left the signoff's portable representation to exports
• docs/roadmap.md Milestone 5 ("trainee packet generation")