[backportbot-libresign]

Bug-fix-only backport of the footer integrity fixes from #9217 to stable35. Related to #8715, but not a backport of the policy-lifecycle architecture intended for Nextcloud 36.

Confirmed defects in stable35

1. A sent request can be signed after an administrator changes the footer policy. Previously, SignFileService::getPdfToSign() passed the stored footer through a live policy resolution, and buildValidationUrl() independently read the current policy. The resulting stamp/QR code and validation URL could differ from the value established for the request.
2. An update of a previously sent request, including one returned to draft, could re-resolve and replace its stored footer. Resending the same value must be harmless; changing it must return HTTP 422.
3. The UUID update path skipped add_footer in core-flow synchronization. As a result, changes selected for an existing, never-sent draft could silently fail to update the stored snapshot. That draft-only omission is corrected without changing frozen requests.

Fixes (limited to stable35 behavior)

• Use the already-persisted policy_snapshot.add_footer.effectiveValue when signing a frozen request, both for the PDF stamp and for the signature validation URL. Fall back to current policy resolution for never-sent drafts and legacy sent requests without a stored footer.
• Reuse the monotonic policy_snapshot_frozen_at marker already backported in [stable35] fix(stable35): keep signature rejection frozen after signing starts #8993 and retain a status-based fallback for legacy records; documents inherit the envelope's frozen state. The helper is local to the stable35-compatible file-policy path, without introducing the main-branch PolicySpec lifecycle API.
• Reject changed footer overrides after the first send while allowing an identical or absent override. Synchronize the footer only while a request is still a never-sent draft.
• Avoid offering the footer template selector in the sidebar once the request's available status/metadata indicate it has been frozen.
• Preserve the existing security check against unauthorized validationSite request/personal-preference overrides while allowing authorized administrative policy values to be inherited.
• Adapt regression fixtures to stable35's existing filesystem access and registered policy count. No production filesystem-access refactor is included.

Explicit exclusions

• No backport of the new global policy lifecycle classifications from Define lifecycle and persistence semantics for request-scoped policies #8715/fix: keep request policy snapshots frozen once the request is sent #8984 (planned for the next major release).
• No full backport of fix: freeze the signature flow once the request is sent #9062: its file-duplication bug fix was separately backported in [stable35] fix: prevent duplicate files after failed updates #9196; this PR does not change signature_flow semantics.
• No docmdp or signature-rejection behavior changes, database migrations, public response-contract additions, broad dependency upgrades, or generalized policy-engine refactor.

Regression and verification

• PHPUnit: frozen vs. never-sent/legacy request; envelope inheritance; same/changed footer; stored stamp and validation URL; UUID draft synchronization; unauthorized validation-site persistence.
• API: draft-to-sent transition and HTTP 422 after freeze.
• Vitest: footer request sidebar behavior on frozen vs. draft requests.
• Static/style/type checks and the database-specific PHPUnit/Behat workflows are executed by the normal CI on each new commit. The latest correction is 23e327c5 (signed with DCO). Wait for every required check to pass before merging.
• No Playwright screenshots are versioned.

Backport note

The automated cherry-pick history contains one empty commit (5e0cdb7); its diff is empty. It is kept to avoid rewriting already published signed history. The effective PR diff should be reviewed independently from the commit count.

Merge is intentionally left to a human reviewer; no automatic merge requested.