Add trusted public module catalog installs

docs/DEPLOYMENT_OPERATOR_GUIDE.md

@@ -278,12 +278,15 @@ through the same trusted address range.
 | --- | --- |
 | `GOVOPLAN_MODULE_PACKAGE_CATALOG_URL` or `GOVOPLAN_MODULE_PACKAGE_CATALOG` | Module package catalog source. |
 | `GOVOPLAN_MODULE_PACKAGE_CATALOG_TRUSTED_KEYS_FILE` | Preferred production keyring path. |
-| `GOVOPLAN_MODULE_PACKAGE_CATALOG_APPROVED_CHANNEL` | Approved catalog channel, for example `stable`. |
+| `GOVOPLAN_MODULE_PACKAGE_CATALOG_APPROVED_CHANNELS` | Comma-separated approved catalog channels, for example `stable`. The legacy singular name remains readable during migration. |
 | `GOVOPLAN_LICENSE_TRUSTED_KEYS_FILE` | Trusted license issuer keyring path. |
 | `GOVOPLAN_LICENSE_ENFORCEMENT` | Enables license enforcement when set to `true`. |
 
 Trust roots are deployment-managed and should not be editable through the
-running WebUI.
+running WebUI. When no catalog override is configured, the Admin package
+directory uses GovOPlaN's public stable catalog and the trust anchor bundled
+with the installed Core release. Production operators may still pin a newer or
+institution-specific catalog/keyring explicitly with the settings above.
 
 ### Mail Test Credentials
 

docs/MODULE_ARCHITECTURE.md

@@ -1476,6 +1476,10 @@ The installer preflight is intentionally conservative:
 - the `shared` state profile blocks in-place package mutation; clustered
   installations must roll one verified immutable module composition across all
   replicas;
+- official runtime images carry the full verified package profile, while the
+  desired module graph controls activation and tenant/View/Policy contracts
+  control availability and presentation; package lifecycle must not be reused
+  as a tenant or user visibility switch;
 - installed module manifests must be compatible with the supported manifest
   contract and current core version;
 - uninstalling `tenancy`, `access`, or `admin` is blocked;

docs/RELEASE_DEPENDENCIES.md

@@ -197,6 +197,13 @@ If both file and URL are set, the URL wins. The cache is used when a remote
 fetch fails, so an operator can still inspect the last known catalog. A cached
 catalog must still pass signature, freshness, channel, and replay validation.
 
+If neither source is configured, the Admin package directory discovers the
+official public stable catalog at
+`https://govoplan.add-ideas.de/catalogs/v1/channels/stable.json`. Core verifies
+that fallback against the public key pinned in the installed Core package. An
+explicit deployment catalog always takes precedence; a configured source that
+is unavailable or invalid fails closed instead of silently falling back.
+
 An official catalog is a JSON object with:
 
 - `catalog_version`
@@ -212,6 +219,8 @@ Each module entry can declare:
 
 - backend package name and pinned install reference
 - WebUI package name and pinned install reference
+- `artifact_integrity` for each package, including the HTTPS registry URL,
+  filename, byte size, SHA-256, package identity, source tag, and source commit
 - display metadata and tags
 - `license_features`, the feature entitlements required to plan that install
 - `dependencies` and `optional_dependencies`, the module ids expected in the
@@ -302,6 +311,12 @@ Catalog provenance changes preflight severity:
   plans, so operators can still use offline or emergency package refs
 - valid-catalog warnings, such as intentionally unsigned local catalogs when
   signature enforcement is disabled, remain warnings
+- a saved catalog plan must match the currently validated entry exactly;
+  altered package refs, artifact identities, channel, sequence, trust state, or
+  signing-key identity block the run and require replanning
+- a trusted remote artifact is downloaded before mutation into a private
+  SHA-256-addressed installer cache, checked for exact size and digest, and
+  passed to `pip` or npm only as that verified local file
 - selected catalog entries with unsatisfied non-optional named interface ranges
   block activation before the installer runs
 - selected catalog entries whose target dependencies are neither installed nor
@@ -519,6 +534,11 @@ Catalog entries can require license features:
 Core checks those requirements against an offline license file before allowing
 the entry into the install plan.
 
+Official open-source GovOPlaN entries do not declare license features. The
+license contract remains generic for external catalogs, deployment presets,
+configuration/package directories, and support offerings; it gates only an
+entry that explicitly asks for a feature.
+
 ```bash
 GOVOPLAN_LICENSE_FILE=/srv/govoplan/license.json
 GOVOPLAN_LICENSE_ENFORCEMENT=true