Add record identifiers page

[stevenvegt]

Summary

Adds a page on record identifiers: what they can disclose, and how receivers recognize the same record across systems.

• Problem statement: identifiers travel further than the records they name; failures are disclosure and recognition errors (undetected duplicates, false merges).
• Risks: who sees identifiers without content access (unauthorized recipient, observer, coalition) and which schemes fail (ordered, time-encoding, concatenated, derived, low-entropy, volatile).
• Passing schemes with worked examples: random (UUIDv4), keyed transformation (HMAC or deterministic encryption), per-recipient; business identifier uniqueness mechanisms and identity claim verification steps.
• Requirements REQ-01 to REQ-12, allocated to the level that owns each decision: trust framework (baseline), information standard (when to require business identifiers, reference and notification styles, human use), vendor (scheme, key custody).
• Related work: Nictiz deduplication guideline, NHS England identifier policy, US Core, IHE mCSD, FHIR core.

Status

Draft for working-group review. Open issues are listed at the end of the page: key custody and rotation, audience-scoped notification design, a trust-framework-designated system URI versus urn:ietf:rfc:3986, and alignment with Nictiz Objectidentificatie.

Notes

• Only the page itself is included; the sushi-config page registration and menu entry are intentionally left out until the content settles.