feat(browser-evidence): add governed evidence authority

[yaacovcorcos]

User effect

Adds the production-dark authority kernel needed for future browser-assisted scientific evidence work. The kernel can bind a bounded browser operation to the exact actor, project, provider thread/turn, tab, document, navigation, and document digest; record digest-only source provenance; create annotation/proposal/verification receipts; and reserve accept, reject, and export decisions for an explicit manual user action.

This PR does not expose a browser, transport, server route, UI, persistence adapter, publication path, or live-data integration. It is a separately governed architecture-foundation lane, not a claim of live-product readiness or a small fast-lane feature.

Provenance and disposition

Scient-native reimplementation inspired by these Synara concept commits:

• 8f6521a67b77a849febef920e96e57acbfc89335
• e3850b69cb55ee4fdb709a3bce9ee0e185732c6c
• c67ccc72326a7e7351b998033a0f3b524b156e64
• f16bda8efde8e1fc1e3b0a7c4e3e543d3145efe7

No donor source was copied. The repository's root MIT notice remains applicable. The design deliberately excludes Synara product identity, persistence, browser transport, publication authority, and automation truth semantics.

Exact scope

• Base: 6d5530f8a19b001d0e3f0e6cfd8156bf20ded926 (feature/scient-automation-operation-authority-a1)
• Head: 161b9b151560967189c794977871b196d8ed7d7e
• Four added files, 3,395 additions, 0 deletions
• Production: apps/server/src/browserEvidence/authority.ts, contracts.ts, PROVENANCE.md
• Tests: apps/server/src/browserEvidence/authority.test.ts

Protected decisions:

• trusted host time and leases capped at five minutes
• exact operation envelope and canonical payload replay binding
• exact actor/project/thread/turn/tab/document/navigation/digest scope
• hostile provenance stores digests, not raw source URLs or paths
• source and automation context are evidence inputs, never scientific truth
• accept, reject, and export remain manual-user-only
• publication is unsupported

Review repair

The defensive scan reproduced a cross-document annotation bug on the pre-repair head: a source receipt from one document could be paired with an annotation lease for another document within the same project/thread. Commit 161b9b151 repairs this before operation replay consumption or receipt append by requiring exact source-document equality. The regression proves matching success plus independent tab, document, navigation, and digest mismatch rejection.

Verification

• Focused browser-evidence authority suite: 33/33 passed
• Server typecheck: passed (9/9 workspace tasks)
• bun run fmt:check: passed
• bun run lint: passed with no errors; existing repository warnings remain, including one intentional sparse-array test warning in this lane
• brand check: passed
• full bun run test: 12/12 tasks successful; CLI 2,873 passed and 10 skipped
• full build: 5/5 tasks successful
• git diff --check: passed
• exact-head worktree: clean

No computer use, browser automation, screenshots, geometry checks, visual tests, visual regression, or manual UI acceptance were performed.

Independent final reviews

Exactly three non-author reviews certified head 161b9b151560967189c794977871b196d8ed7d7e with no unresolved P0, P1, or P2 findings:

1. correctness/reliability/lifecycle/concurrency review
2. security/privacy/data/permission/approval/publication-safety review
3. architecture/maintainability/Scient-ownership/lineage/test-sufficiency review

The architecture review explicitly classifies this as a separately governed production-dark foundation, not ordinary fast-lane product work.

Rollback and limitations

Rollback is removal or revert of the four isolated browser-evidence files; no migration, live state, credentials, transport, or user data is involved.

Before any live composition, a later governed lane must add durable storage with atomic compare-and-set behavior and bounded retention, host-attested digests from captured bytes, canonicalization depth/cycle bounds, and restart/concurrency proof. The host-only lookup/revocation surface must remain unexposed. This PR provides no live browser behavior by itself.

Dependency status

Depends on draft PR #182, which in turn depends on the existing operation-authority stack. Keep this PR draft and stacked until its bases are reviewed and integrated in order.

[yaacovcorcos]

Final alignment evidence: normally merged updated #182 with no conflicts; exact head daaee9a. Browser-evidence authority checks 33/33, server typecheck and diff check passed. Hosted exact-head CI is fully green. Combined stack final-head review is in progress.