fix(provenance): validate an explicit issued_at before coercing it

[imran-siddique]

Closes #320.

build_record() ran int(issued_at if issued_at is not None else time.time()) at provenance.py:238 and handed the converted value to _check_structure(), whose guard at line 202 carries the comment "bool is an int subclass, and True would otherwise pass as a timestamp". The order defeated the guard, which can only speak about what the caller passed.

Reproduced at 57d5165, with the two controls that have to keep working:

ACCEPTED  issued_at=True     -> record issued_at=1
ACCEPTED  issued_at=False    -> record issued_at=0
ACCEPTED  issued_at=1.9      -> record issued_at=1
ACCEPTED  issued_at='123'    -> record issued_at=123
ACCEPTED  issued_at=-0.5     -> record issued_at=0
TypeError  issued_at=[1]       (undocumented class)
ValueError  issued_at='abc'    (undocumented class)
ACCEPTED  issued_at=None     -> record issued_at=1789187091
ACCEPTED  issued_at=123      -> record issued_at=123

-0.5 becoming an accepted 0 is the diagnostic case: a negative non-integer turned into a valid-looking timestamp. The two undocumented exception classes come from the same line, and no caller written against this module's contract catches them.

Change

One line. An explicitly supplied value reaches _check_structure() untouched; only an omitted one is stamped with int(time.time()). That puts isinstance in front of the conversion, so the five coercions and the two leaked classes close together.

Distinct from #142 and #146: those moved the structural rules into the shared helper, and the helper was always strict. The caller path defeated it by normalizing first.

Why nothing caught it

tests/test_public_functions_raise_what_they_document.py listed provenance.build_record under NO_ARGUMENT_TO_SWEEP because the function has no positional argument, so the junk matrix never reached it. It is now in CALLS with issued_at as the varied argument and every other argument valid, per that file's own warning about a second-argument TypeError reading like a leak in the first, plus a REACHES witness so a sweep that never arrives cannot report clean.

Verified in both directions

• With the fix: tests/test_provenance.py 127 passed, the sweep file 58 passed, repository 1429 passed.
• Against origin/main's provenance.py: 10 of the new provenance cases fail, and the sweep reports both test_no_public_function_raises_an_undocumented_exception[provenance.build_record] and test_the_sweep_actually_reaches_each_function[provenance.build_record].
• The parametrized coercion test asserts int(supplied) == was_coerced_to before asserting the refusal, so if the coercion this pins ever stops being the one, the test fails rather than passing quietly.
• The four repository-wide failures in test_generators_reproduce_fixtures.py and test_safe_integer_range.py are pre-existing Windows path-separator artifacts, confirmed on a clean origin/main worktree.

Reported by @altrudev. The two undocumented exception classes and the reason the sweep never saw them were found by @lywinged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X27MBo6tGVw1UmmchuGFnW