fix: recover stripped parent provenance for v1.0.33

[ictechgy]

Summary

• recover the nearest exact live lterm parent when environment-stripping wrappers remove explicit provenance
• keep explicit capability/TMUX provenance authoritative and fail closed on malformed or stale explicit state
• revalidate inferred ancestry after spawn and under the session lock before commit
• prepare package/docs/contracts for v1.0.33 without fabricating a pre-tag Homebrew archive checksum

Safety and rollout

• raw attach streams and whole-window tmux behavior are unchanged
• fixed OMX containment must be deployed and verified before publishing lterm v1.0.33
• packaging/homebrew/PENDING_RELEASE records the intentional formula lag; after the authorized tag exists, update URL/assertion/SHA together and remove the marker

Verification

• scripts/release-preflight.sh --require-audit
• 664 unit tests, 268 CLI smoke tests, lifecycle/integration suites, ignored upgrade matrix 2/2
• release build and contract/schema/drift checks
• cargo audit: no vulnerabilities; existing allowed RUSTSEC-2026-0190 warning
• isolated OMX rollback E2E against this local binary: real private tmux + disposable private lterm, 2/2