appEvents.status free-text drift (7739 rows, ~25% coverage of declared union)

db-venus-cc measured while reviewing VENUS-306/308: appEvents.status is unconstrained free text, already drifted across 7739 live rows — NULL 5819 (15 different categories), failure 983, success 678, denied 256, plus off-union 'ok' 2 and 'test' 1 (predates tonight by 6 weeks). The documented success|failure|denied union describes ~25% of rows; any query filtering on status is unreliable table-wide. Venus bans CHECK constraints on label sets (see commons), so fix is a lookupOptions grupo + write-boundary resolution, not a constraint. Also needs a decision: does NULL mean not-applicable, or does it mean nobody ever set it (those may need different remediation). VENUS-308's identityBound invariant check must NOT key on status at all — key on action='identityBound' scoped to category='auth' (db-venus-cc already building it that way).