Add governed organization template upgrades

docs/ORGANIZATION_MODEL.md

@@ -44,9 +44,19 @@ model:
   policy.
 
 This avoids ambiguous inheritance when institutions model responsibility
-differently. Template catalogue, instantiation, and upgrade orchestration are a
-separate implementation slice; the existing organization tables remain the
-canonical tenant-local state.
+differently. Template catalogue, instantiation, and explicit upgrades are
+available through the Organizations API and administration surface. The
+existing organization tables remain the canonical tenant-local state.
+
+An upgrade starts by persisting a three-way comparison of the source template,
+the current tenant-owned model, and a newer published template version. The
+preview distinguishes compatible additions and changes from local divergence,
+destructive remapping, and invalid references. Local-only changes are retained;
+conflicts require an explicit keep, replace, or bounded mapping decision. The
+apply operation rejects stale source, target, or local state and records a new
+instantiation plus platform event. Cancelling a preview records the outcome but
+does not change tenant data. Consumers of organization references must respond
+to the applied event; Organizations does not rewrite another module's records.
 
 ## Boundary With Identity And IDM