Frozen replay: persist fallback source provenance without weakening content-addressed identity #392

Follow-up to #388, #378, and transport ownership #331.

Frozen replay should preserve enough provenance to explain whether immutable bytes came from a GitHub Release asset, GHCR, a reconstructed GitHub tag archive, or an explicitly configured mirror, while digest/version/commit remain the security identity.

Acceptance criteria:

• lock/receipt metadata records a stable source-kind/provenance descriptor, not credentials or ephemeral signed URLs;
• file:// ambient paths are never committed as portable provenance;
• the content digest and immutable revision remain authoritative; provenance alone cannot authorize changed bytes;
• frozen reinstall from an empty store works when the original registry is unavailable;
• tag-archive reconstruction is distinguishable from published Release bytes;
• backwards-compatible read path for existing lockfiles, with an explicit versioned migration if schema change requires it;
• independent test-org coverage.