Document update provenance for contributions

[hamzamerzic]

Summary

• record the exact live-source checkout and commit beside every reviewed contribution
• cover linked reviews, standalone App Store app reviews, and platform reviews
• bump Contribute to 0.5.10

Why

A locally contributed change can later land upstream with a squash or rebase identity. Ordinary Git then sees two edits to the same lines and can raise a repeat conflict even though both changes came from the same reviewed work.

This is the preparation half of the paired platform fix: Contribute now preserves a narrow, verifiable source witness when an owner sends a review. The platform can use that proof after the reviewed change lands, while ambiguous cases still fall back to the normal conflict flow.

Validation

• npm test — 123 passed, 8 component-render checks skipped because the standalone test environment does not provide frontend modules
• app validation — 0 errors; 2 existing GitHub-host warnings

[hamzamerzic]

Superseded by the reviewed integration in #33, which preserves this PR's commits and authorship. Thank you — the combined change is now on main.