Version middleware snapshots so callers can reject stale policies. Existing Rebuild callers remain supported. Validation: middleware race tests and scoped lint passed.