feat: record analysis provenance beside the findings

[REPPL]

Ships intent itd-8, narrowed from "a flag that points the rubric at a local model" (which the host-delegated architecture has no backend for) to recorded provenance.

• analyze -ingest -backend local|cloud [-model NAME] writes one kind: provenance record as the first line of findings.jsonl, in the same atomic batch as the findings; a re-ingest replaces it with them, verdicts stay protected.
• report prints the declaration under Findings, marked "as declared at ingest"; a file without the record reads "not recorded".
• Without the flags nothing changes but what is recorded: the file says the backend was not recorded and the run says so on stderr.
• New how-to documents the fully local route end to end; the privacy explanation makes the "nothing leaves" statement conditional on that route and calls provenance a declaration, not a measurement; the ethics brief's stale "local LLM variant" claim is corrected.
• Spec closed and intent shipped in the same change; fidelity audit ingested (six of six criteria met).

Assisted-by: Claude:claude-fable-5-1