fix(gate): provenance line reflects envelope-mode thresholds

[lostmartian]

What

The G7 Gate: … provenance line now describes the gate that actually judged the run. In statistical-envelope mode it renders the scenario tolerances + envelope identity:

Gate [statistical envelope: default, N=3]: divergence_ceiling=0.35, max_cost_increase_pct=20.0%, step_count_std_dev=2.0, fail_on_identical_loops=true — source: agentdiff.toml (…)

Strict/v1 baselines keep the legacy max_divergence/max_loops/max_cost_delta line unchanged.

Why

Found on agentdiff-demo: in envelope mode the line reported the legacy knobs (0.3 / 0 / 10%) while compare_envelope actually judged with the scenario tolerances (0.35 / 20% / 2σ). G7's whole point is that a green check is auditable against the rules that produced it — the line was misdescribing envelope runs.

How

• provenance_line() gains optional scenario_cfg/envelope params; when the envelope is statistical (N ≥ 2) it renders scenario tolerances + [statistical envelope: <name>, N=<n>] prefix.
• cli.py: the provenance call moved after load_baseline() (mode is only known there) and passes both; removed the now-dead early call.
• 3 new tests: statistical with scenario config, statistical with defaults, strict keeps legacy form.

Testing

• make lint → All checks passed
• uv run python -m pytest → 432 passed

Checklist

• Exactly one logical change in this PR
• make lint passes
• uv run python -m pytest is green
• Docs updated if user-facing
• CHANGELOG.md entry added under [Unreleased] (if feat/fix)
• Conventional title: type(scope): summary

Roadmap link: WS-G G7 gate provenance — 0.5.0 polish.

[cloudflare-workers-and-pages]

Deploying agentdiff with    Cloudflare Pages

Latest commit:	60b617a
Status:	✅  Deploy successful!
Preview URL:	https://8cddb4c4.agentdiff.pages.dev
Branch Preview URL:	https://fix-envelope-gate-provenance.agentdiff.pages.dev

View logs