feat: add institutional governance and recovery contracts

tests/test_module_system.py

@@ -1261,6 +1261,41 @@ finally:
         self.assertIn("module_active", {issue.code for issue in preflight.issues})
         self.assertIn("module_desired", {issue.code for issue in preflight.issues})
 
+    def test_module_installer_blocks_node_local_package_mutation_in_shared_profile(
+        self,
+    ) -> None:
+        plan = ModuleInstallPlan(
+            items=(
+                ModuleInstallPlanItem(
+                    module_id="files",
+                    action="update",
+                    source="manual",
+                    python_package="govoplan-files",
+                    python_ref="govoplan-files==1.2.3",
+                ),
+            )
+        )
+        with patch.dict(os.environ, {"GOVOPLAN_STATE_PROFILE": "shared"}):
+            preflight = module_install_preflight(
+                plan=plan,
+                available={
+                    "files": ModuleManifest(
+                        id="files",
+                        name="Files",
+                        version="1.2.2",
+                    )
+                },
+                current_enabled=("files",),
+                desired_enabled=("files",),
+                maintenance_mode=True,
+            )
+
+        self.assertFalse(preflight.allowed)
+        self.assertIn(
+            "immutable_cluster_release_required",
+            {issue.code for issue in preflight.issues},
+        )
+
     def test_module_installer_preflight_blocks_incompatible_manifest(self) -> None:
         root = Path(tempfile.mkdtemp(prefix="govoplan-installer-compat-", dir=_TEST_ROOT))
         settings = _settings(root)