feat(verify): report generated CLI provenance

[samzong]

Problem

__lathe verify --json proves catalog/Cobra/auth/Skill/workflow consistency, but its report contains only a report version, pass/fail state, and check results. It does not identify which Lathe generator/runtime contract or which synced source revisions produced the binary.

The information exists in separate places: CLI build information is available through VersionInfo, schema versions are compiled into the runtime, and spec sync records backend, source kind, pinned input, and resolved SHA. Generated Skill references already include some source state. An agent inspecting only the binary cannot assemble this provenance reliably.

Proposal

Compile a minimal, non-secret provenance record into generated output and include it in __lathe verify --json.

Useful fields are:

• generated CLI version and commit when available;
• Lathe generator/runtime contract version;
• command and catalog schema versions;
• per-source ID, backend, source kind, and resolved immutable SHA;
• an explicit non-reproducible marker for local_path sources.

Do not embed credentials, authenticated repository URLs, or absolute local filesystem paths.

Alternatives considered

The version command identifies the CLI build but not the source inputs. Sync-state files identify inputs but are not shipped with every binary. Generated Skill files may be absent unless bundling is enabled.

Acceptance criteria

• The verify report is self-contained for binaries produced from pinned sources.
• Local sources are marked non-reproducible without exposing their absolute path.
• Report schema changes are versioned.
• The human-readable verify output and generated Skill explain the same provenance.
• Existing verification checks remain deterministic and offline.

Affected surface

Normalization/codegen; command catalog/search; generated Skill docs.