feat(provenance): add shared envelope schema

[solomonneas]

Summary

• Add the shared brigade.provenance-envelope.v1 Python builder and validator.
• Add the matching Go envelope types, validator, exact-byte hashing, and legacy synthesis.
• Ship cross-language golden fixtures and the brigade.trust-policy.v1 entitlement policy as package data.
• Document the work-import and MiseLedger storage contracts.

Why

Issue #582 establishes the provenance contract needed by the ingestion, transport, enforcement, and migration slices in #583 through #587. The shared fixtures keep Python and Go aligned on UTF-8 hashing, nullable fields, the 4096-byte ceiling, locator safety, and inbound trust authority.

Verification

• ./scripts/verify: passed in Brigade receipt 20260728-025531-work-verify-7e48a0
• go vet ./...
• go test ./...
• Vale on both edited schema documents

Closes #582

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 001b973b-cb96-468e-8ed4-dae70d12145d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/582-provenance-envelope

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}