Split provenance loader modules

[yvette-carlisle]

Summary

• Split provenance loader root into bundle_tables and history_events modules.
• Kept the service-facing loader API reexported from loaders.rs.
• Made proposal/review history SQL helpers private to the history events loader.
• Added child-module tests for memory-history assembly ordering, limits, and event composition.

Validation

• cargo make fmt-rust
• cargo check -p elf-service --all-targets --all-features
• cargo nextest run -p elf-service --lib --all-features provenance (5 passed)
• cargo make lint-vstyle
• cargo make lint-rust
• cargo make fmt-rust-check
• git diff --check
• cargo make check-rust
• cargo make test-rust (397 passed, 92 skipped)
• cargo make check (397 passed, 92 skipped)

Review

• Scout selected provenance loaders as the safest next production-code modularization slice.
• Skeptic passed with no blockers or material risks.