Reconcile landed contributions by provenance

[hamzamerzic]

Summary

• record a durable, hash-verified relationship between an owner-reviewed contribution, the local source commit it came from, and the GitHub commit where it landed
• let both shell updates and App Store updates use those proven shared changes as a semantic merge base when squash, rebase, or integration batching changed commit identities
• preserve later local edits, import only verified review commits for standalone app checkouts, and carry app witnesses across history replay only when the local change survived
• keep ordinary Git and the owner-gated resolver as the fail-closed path whenever source ancestry, reviewed bytes, upstream containment, or the final merge cannot be proved

Safety model

The updater never infers equivalence from a clean result alone. A witness is created only after the stored review diff re-hashes exactly and is proven in the local source, including a narrow agent-resolved projection proof that requires the same changed path set and independently verifiable non-conflict paths. It becomes authoritative only after GitHub reports the PR merged and the exact reviewed delta is present in that merge commit. Resolution is computed off-tree; shell commits retain both real parents, app updates retain their existing replay transaction, and obsolete landed witnesses are retired only after the update is durable.

Prior work

#147 and #280 manually integrated batches of already-reviewed production changes, preserving provenance but requiring bespoke reconciliation. #282 then reproduced the underlying failure mode directly: its reviewed local commit and GitHub squash commit have identical trees and parents but different identities, while later local work on the same lines made ordinary Git report a three-file conflict. This PR turns that repeated manual reasoning into one shared, fail-closed mechanism.

Validation

• exact upstream review branch: 421 focused backend tests passed
• integrated local branch: 426 focused backend tests passed
• frontend: 2,098 library tests and 63 hook tests passed; production/PWA build passed
• Contribute app: 122 JavaScript tests and 7 Python tests passed; app validation passed
• full backend sweep reached 3,023 passes; its two failures reproduce outside this diff in existing live-context/update-preview fixtures
• replayed the real Steer modified-Enter messages without queue flash #282 history in an isolated clone: ordinary Git reported the same three conflicts, the provenance engine selected the verified resolved projection, and the resulting tree was byte-for-byte the current local tree
• git diff --check passed

[hamzamerzic]

Merged to main as part of #304. The provenance reconciliation and its tests are now in the integrated default-branch change.