feat: add deterministic cleared project media

docs/asset-clearance-template.md

@@ -0,0 +1,35 @@
+# Private asset clearance register template
+
+This template is for a private, untracked approval record. Do not place completed approvals, private source paths, original filenames, private product names, account details, or health data in the repository.
+
+## Required preparation evidence
+
+- Preparation date and reviewer.
+- Generic asset ID.
+- Candidate derivative filename and SHA-256 hash.
+- Rights holder and display permission confirmed.
+- Final derivative reviewed at readable size.
+- OCR, barcode/QR, byte, container, and metadata checks passed.
+- No browser chrome, account data, real health data, private branding, or identifying title frames.
+- Video gameplay range and every materially changing frame reviewed.
+- Health-related UI contains only fictional/demo information.
+
+## Approval file shape
+
+The private approval JSON must match `portfolio-asset-approvals/v1`. It is copied from the generated private `candidate-approval.json` only after visual review. Any later byte change invalidates approval because the SHA-256 hash changes.
+
+```json
+{
+  "schema": "portfolio-asset-approvals/v1",
+  "assets": [
+    {
+      "id": "generic-asset-id",
+      "files": [
+        { "fileName": "project-generic-output.webp", "sha256": "64-lowercase-hex-characters" }
+      ]
+    }
+  ]
+}
+```
+
+The preparation command stages candidates and creates a private contact sheet. It publishes nothing until this exact hash-bound register is supplied. The public manifest and prepared asset directory must remain empty while approval is pending.