Add Work identity and evidence with separate composition provenance

[heznpc]

Work can change a session's project attribution when repository inputs refresh even if the session index is unchanged. Using the session run for both claims would assign one provenance reference to different facts.

Add validated identity, evidence reference, coverage and producer snapshot types to ModoreDomain. The Work adapter emits separate provider-recorded workspace observations and inferred project attributions. Each accepted input publication advances the composition run; only a session-index publication advances the workspace collection run. Getter/body evaluation and stale-write generations do not create provenance IDs.

WorkProject exposes optional identity and attached attribution evidence while preserving its existing String ID, equality, ordering, selection and UI. The existing mapping algorithm now also reports which rule it used. Empty workspaces remain unassigned without evidence. Collection failure cannot be encoded as a positive record, and transcript invocations cannot be promoted to observed successful access. Storage, runtime and action behavior are outside this change.

Validation:

• Shared domain: 16 tests pass with warnings as errors and complete strict concurrency.
• Mac app: all 521 tests pass under the same compiler policy.
• New tests cover source/run/record validation, failed snapshots, transcript semantics, root-only remapping, stable repeated adaptation, accepted publication versus cancelled loads, and unchanged Work IDs/equality/selection.
• The native source launcher built and launched the app. The running Work UI loaded its project list; project expansion and metadata filtering/restoration were verified.
• Full GitHub CI and CodeQL passed for this head, including iOS, Windows, Linux, macOS Python, Mac Swift tests and the Universal 2 DMG build/audit.

Follows the design integrated in #110. The contract now records the separate composition provenance boundary.