Use unknown sentinel for missing model provenance

[NovasPlace]

Summary

When a memory write has no caller-supplied model identity, MemoryManager currently persists:

source_model_id = "default"

That looks like an attribution value even though no model identity was actually known.

This changes the fallback to the runtime's existing explicit sentinel:

source_model_id = "unknown"

Caller-supplied model IDs continue to win unchanged.

Scope

• one production fallback literal
• existing public/base provenance tests updated to require unknown
• no historical rewrites
• no schema changes
• no governance eligibility changes in this PR

The provenance audit from #113 keeps separate counts for historical default placeholders and unknown values.