feat(canopy-eligibility): wire SSA-linked flags through orchestrator to canopy-medicaid Phase D

Context

The medicaid 38-COA expansion Phase D plan (now archived) shipped the COA evaluation logic for ABD FBR SSA-linked categories — Pickle (PAMMS 2120), DAC (PAMMS 2122), Disabled Widow (PAMMS 2124), Widow 60-64 (PAMMS 2126), Former SSI Disabled Child (PAMMS 2128). The MagiInput / NonMagiInput structs in services/canopy-medicaid/src/rules_client.rs carry the flags (lost_ssi_due_to_cola, is_disabled_adult_child, is_disabled_widow, is_widow_60_64, lost_ssi_as_disabled_child).

What's missing: the orchestrator (services/canopy-eligibility/src/orchestrator.rs) doesn't fetch SSA data or populate these flags before sending the ApplicationContext to canopy-medicaid. Today they're always false, so the SSA-linked COAs are unreachable in production even though the eligibility logic is implemented.

This is acknowledged in:

  • roadmap.adoc Tier 5.7 line 718 ("Deferred SSA wiring for Medicaid Phase D")
  • roadmap.adoc Tier 5.5 line 858 (Noop adapter rationale)
  • The Phase D plan errata at docs/modules/ROOT/pages/plans/archive/medicaid-coa-phase-d-abd-fbr-ssa.adoc:335

…but no GitLab issue tracks it. Surfaced by the multi-agent audit 2026-05-05.

Acceptance criteria

  • Orchestrator's ApplicationContext builder fetches SSA SOLQ/BINDEX data from canopy-verification (NoopSaveAdapter is the dev stand-in; CMA-gated for prod).
  • All five SSA-linked flags populate from real SSA response shapes.
  • Integration test asserts a Pickle-eligible person evaluates as such end-to-end (orchestrator → medicaid → assigned_coa = pickle).
  • Same for at least DAC and one Widow variant.
  • Errata in the archived Phase D plan flips to RESOLVED with a pointer at this issue's MR.

Dependencies

  • canopy-verification's NoopSaveAdapter is the dev stub; production blocks on the SSA Computer Matching Agreement.

Surfaced by

Multi-agent plan-vs-code audit, 2026-05-05. Roadmap acknowledged, never tracked.