ki/quota: Hash-Bindung atomar bis in den Publish-Lock, roter Re-Check lehnt ab, Kontingent-Altbestand (Block 7, U02–U04)

- Jobs speichern Ergebnis nur per bedingtem UPDATE auf den analysierten Hash;
  publish() prüft bei ki/scheduler unter der Zeilensperre die jüngste gültige
  Klassifikation und plant sonst eine neue Prüfung ein (StaleClassificationException)
- Re-Check ohne Routing: Rot bei einer PM in Review lehnt wie die Erstprüfung ab
- consumePublishSlot() zählt eine NULL-Periode wie den laufenden Monat;
  Backfill-Migration setzt die Periode für Altverbrauch
- ApiPortalResolutionTest: gemeinsame Kategorie wegen der U10-Prüfung

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/Feature/PressReleaseSchedulingTest.php

@@ -8,6 +8,7 @@ use App\Models\KiAudit;
 use App\Models\PressRelease;
 use App\Models\PressReleaseStatusLog;
 use App\Services\PressRelease\PressReleaseService;
+use App\Services\PressRelease\StaleClassificationException;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Artisan;
@@ -316,3 +317,100 @@ test('the scheduler re-checks a due release whose classification predates the la
         && $job->route === true
         && $job->contentHash === $stale->fresh()->content_hash);
 });
+
+test('an automatic publish refuses a classification whose hash no longer matches the locked content (Audit U02)', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+
+    $pr = PressRelease::factory()->create([
+        'status' => PressReleaseStatus::Review->value,
+        'classification' => PressReleaseClassification::Green->value,
+        'title' => 'Version zwei',
+        'text' => 'Inhalt zwei',
+        'published_at' => null,
+    ]);
+    // Grünes Urteil gehört zu Version eins – die PM trägt inzwischen Version zwei.
+    KiAudit::factory()->create([
+        'press_release_id' => $pr->id,
+        'type' => KiAudit::TYPE_CLASSIFICATION,
+        'result' => 'green',
+        'content_hash' => str_repeat('a', 64),
+    ]);
+
+    expect(fn () => app(PressReleaseService::class)->publish($pr, source: 'scheduler'))
+        ->toThrow(StaleClassificationException::class);
+
+    expect($pr->fresh()->status)->toBe(PressReleaseStatus::Review)
+        ->and(PressReleaseStatusLog::query()->where('press_release_id', $pr->id)->count())->toBe(0);
+
+    Queue::assertPushedOn('classification', ClassifyPressRelease::class, fn (ClassifyPressRelease $job) => $job->pressReleaseId === $pr->id
+        && $job->route === true
+        && $job->contentHash === $pr->content_hash);
+});
+
+test('a manual admin publish overrides a stale classification (Audit U02)', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+
+    $pr = PressRelease::factory()->create([
+        'status' => PressReleaseStatus::Review->value,
+        'classification' => PressReleaseClassification::Green->value,
+        'title' => 'Version zwei',
+        'text' => 'Inhalt zwei',
+        'published_at' => null,
+    ]);
+    KiAudit::factory()->create([
+        'press_release_id' => $pr->id,
+        'type' => KiAudit::TYPE_CLASSIFICATION,
+        'result' => 'green',
+        'content_hash' => str_repeat('a', 64),
+    ]);
+
+    app(PressReleaseService::class)->publish($pr, source: 'admin');
+
+    expect($pr->fresh()->status)->toBe(PressReleaseStatus::Published);
+    Queue::assertNotPushed(ClassifyPressRelease::class);
+});
+
+test('an automatic publish lets a legacy release without an audit hash through (Audit U02)', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+
+    $pr = PressRelease::factory()->create([
+        'status' => PressReleaseStatus::Review->value,
+        'classification' => PressReleaseClassification::Green->value,
+        'published_at' => null,
+    ]);
+    KiAudit::factory()->create([
+        'press_release_id' => $pr->id,
+        'type' => KiAudit::TYPE_CLASSIFICATION,
+        'result' => 'green',
+        'content_hash' => null,
+    ]);
+
+    app(PressReleaseService::class)->publish($pr, source: 'scheduler');
+
+    expect($pr->fresh()->status)->toBe(PressReleaseStatus::Published);
+});
+
+test('the scheduler counts a stale classification at publish time as a re-check, not as a failure (Audit U02)', function () {
+    /** @var TestCase $this */
+    Carbon::setTestNow('2026-06-01 12:00:00');
+
+    $due = PressRelease::factory()->create([
+        'status' => PressReleaseStatus::Review->value,
+        'classification' => PressReleaseClassification::Green->value,
+        'scheduled_at' => '2026-06-01 11:55:00',
+        'published_at' => null,
+    ]);
+
+    $this->mock(PressReleaseService::class)
+        ->shouldReceive('publish')
+        ->once()
+        ->andThrow(new StaleClassificationException($due->id, str_repeat('a', 64), (string) $due->content_hash));
+
+    $this->artisan(PublishScheduledPressReleases::class)
+        ->expectsOutputToContain('[RECHECK')
+        ->expectsOutputToContain('1 neu zur Prüfung, 0 fehlgeschlagen')
+        ->assertSuccessful();
+});