Where an upgrade’s new code comes from — a raw blob, or a global contract pinned by code hash.
Both are immutable: exactly this code is deployed, then migrate runs. (Global-by-account-id is
deliberately excluded: it is a live delegation to the publisher, so a later republish would swap
the code with no proposal, timelock, or migrate — bypassing governance and bricking versioned
state.)