feat(authoring): integrate input provenance and paired staging

[777genius]

Integrates frozen-input provenance, paired public npm staging/reading, CLI transport, and isolated provenance/stage workflow routes. Input provenance is separate from qualification. Each product is packed once; readers validate retained bytes without repacking, and completed-stage admission still requires all three signatures. Legacy publishing routes remain isolated.

Stacked on #223 at 0003da8. Refs #227, #228 and #208. The owner requested consolidation of reviewed checkpoints to reduce the open PR stack. Combined delta: 10 files, 3,041 changed lines (2,992 additions, 49 deletions); this is an explicit consolidation exception to the normal review target, without history rewriting.

Independent source acceptance: provenance at d7a08b7 (34 focused and 13 independent tests); stage at 4ef512f (56 selected tests); workflows at 0d50e5b (112 Node and 11 Go tests). All required CI passed at those checkpoints and at consolidation head 432819d. Current head 7468726 has the identical Git tree to reviewed 0d50e5b; its new CI is pending. Source-tree identity does not claim a new review of unrelated prerequisites.

Genuine authenticated custody, accepted N2 and checked-artifact kinds, provider/action/tool compatibility, protected execution, full platform/public E2E, qualification and release remain open. Mocked tests and CI do not replace those gates. This consolidation is into the parent feature branch, not main or a public release.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}