Fingerprint overlap should be treated as candidate generation, never as deletion

Fingerprint overlap should be treated as candidate generation, never as deletion authorization. This applies to historical object-storage cleanup when metadata such as ETag, size, MIME, or an available digest suggests duplication but does not prove canonical ownership. Promote an object only after resolving the server-owned source-to-canonical relationship, verifying byte identity and active references, checking retention/holds and tenant scope, and confirming both objects remain readable. Keep all unresolved candidates explicitly excluded and advance them only through bounded previews and separately approved mutations. Limit: this method does not by itself establish retention policy or authorize cleanup across customer tenants.