fix(structured): reserve all four provenance fields, not two

[smaramwbc]

Follow-up to #521, which I merged a moment ago.

The gap

#521 stamps compiler provenance into every compiled memory, which is what #443 asked for. The structured path, though, copies a candidate's metadata wholesale and then overwrites only two of the four provenance keys:

metadata: dict[str, Any] = dict(c.get("metadata") or {})
metadata.update({
    "compiler": "structured",
    "compiler_version": _STRUCTURED_COMPILER_VERSION,
})

So a producer-supplied model or prompt_version survives into the compiled memory. That matters because server/api/admin.py:1383 reads model straight out of this metadata, so GET /admin/subjects/{s}/memories/{id}/compiler-trace would report a model that never touched the memory.

It also contradicts #521's own stated intent that these fields are set by Statewave, and the test named for it (test_structured_compiler_provenance_is_reserved) only supplied the two keys that were already safe.

The fix

Filters all four reserved keys before stamping, and extends that test to supply model and prompt_version too.

Verified by mutation rather than by reading: reverting the filter makes test_structured_compiler_provenance_is_reserved fail, restoring it passes.

Also corrects a comment in the heuristic compiler that still said metadata_ "stays {} exactly as before" when it now always carries the provenance, and adds two missing trailing newlines.

Checks

ruff clean, 1206 unit tests and 321 integration tests pass locally.