test: teach the architecture catalog contract the two provenance shapes

[hivecommons-hive]

CI Fix

Scope claimed: tests/architecture-catalog-contract.test.mjs only — the catalog provenance/required-fields/doc-attribution tests. Disjoint from #812 (scripts/import-architecture-issue.mjs, mdx-escape), #810 (tests/import-architecture-issue.test.mjs), #818 (svg-active-content tests).

The architecture-submission workflow fails its own test:unit gate on every labelled submission: scripts/import-architecture-issue.mjs writes records sourced from the submission issue (sourceIssue + issue URL, no sourceCommit), but the contract required every record to carry a cncf/architecture-pinned sourceCommit. Proven by run https://github.com/cncf/endusers/actions/runs/36493874079 (issue #813) and reproduced locally.

This PR scopes the commit-pinning assertions to upstream-imported records and adds the mirrored contract for issue-submitted ones: sourceIssue is a positive issue number, sourceUrl is the submission issue URL, and the doc page cites the issue. No production code, script, or workflow changes; gates for the cncf/architecture path are unchanged.

Verified locally at 7772dcf:

• import of the [TEST] [Reference Architecture]: Project Bluefin #813 payload + npm run test:unit: red before, green after
• mutation check (wrong issue URL in a record) still fails the new test
• npx prettier --check clean; no other files touched

Closes #819

---

Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "ci-maintainer" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "ci-maintainer". If this is an outreach PR, a human must review it and remove the label.