feat(engine): add source-aware corpus identity substrate

[tcballard]

What changed

• freezes the approved v1 parent-digest, path/provenance, and override operand contracts
• adds typed local/inherited corpus layers, source-aware artifact keys and paths, and runtime-only physical locators
• threads source identity through corpus items, validation rows, relationship endpoints, resolver results, derived/delta generations, freshness state, Sentry, and the MCP graph projection
• corrects the already-shipped corpus-source-identity requirement to Accepted
• leaves the v1 persistent-store bytes and every no-manifest public output unchanged

Why

ADR-135 and ADR-138 require federation to begin with one source-aware identity substrate shared by every later consumer. This PR establishes that substrate without activating parent-manifest behavior or creating an alternate resolver.

Part of #270.

Validation

• cargo test --workspace: 205 passed, 0 failed, 1 ignored differential driver
• cargo clippy --workspace --all-targets -- -D warnings
• persistent-store oracle goldens unchanged
• decided validate decisions/: 462 valid, 0 invalid, 12 skipped
• decided relationships decisions/ --validate: 2,931 checked, 0 issues
• gate: 0 blocking findings; 134 existing advisories
• git diff --check

Stack

Base PR in the corpus-federation implementation stack. Public federation activation remains deliberately dormant until the complete stack is coherent.