feat(#1425): strict_provenance config flag for runtime enforcement

[dimitri-yatsenko]

Summary

T2.2.c of the provenance trinity — completes the trio.

When `dj.config["strict_provenance"] = True`, runtime gates enforce the upstream-only convention inside `make()`:

• Reads must target a table in the active trace's allowed set (declared ancestors + self + self's Parts).
• Writes must target self or self's Parts.
• Inserted rows' PK columns that overlap with the current key must equal the key's values.

Default is False. Existing `make()` bodies are unaffected.

Closes #1425. Slated for DataJoint 2.3.

Branch stack

Layer	PR	Branch
T1.4 cascade fix	#1468	`fix/1429-cascade-part-part-renamed-fk`
T2.2.a `Diagram.trace()`	#1471	`feat/1423-diagram-trace`
T2.2.b `self.upstream`	#1473	`feat/1424-self-upstream`
T2.2.c `strict_provenance` (this)	this PR	`feat/1425-strict-provenance`

Will rebase onto master after the chain merges in order.

What's added

Component	File
Runtime context module — `ContextVar` + push/pop helpers + read/write gates	`src/datajoint/provenance.py` (new)
Config flag `strict_provenance: bool` (default False) + env-var `DJ_STRICT_PROVENANCE`	`src/datajoint/settings.py`
Push/pop context in `_populate_one` around the `make()` invocation	`src/datajoint/autopopulate.py`
Read gate in `QueryExpression.cursor`	`src/datajoint/expression.py`
Write gate in `Table.insert` (after existing `_allow_insert`)	`src/datajoint/table.py`
6 integration tests	`tests/integration/test_strict_provenance.py` (new)

Implementation notes

• ContextVar (not threading.local) so the active-make context propagates correctly across `contextvars`-aware boundaries (asyncio, multiprocessing-with-context-propagation).
• Part-table detection uses class `dict` traversal filtered to `Part` subclasses — `dir/getattr` would trigger the `_JobsDescriptor` and try to lazy-declare `~~table` inside the populate transaction (caught on the first test).
• Read gate is no-op outside make() — checks `ContextVar.get()` returns None.
• Write gate is no-op outside make() — same.

Documented limitation (deferred)

The read gate does not distinguish reads that came through `self.upstream` from reads of the same ancestor via a direct expression. Both are allowed if the table is in the allowed set. The intent is to catch reads from undeclared dependencies; tightening the "must come through self.upstream" path requires propagating an attribution marker through QueryExpression composition and is left for a follow-up.

Tests

• 6/6 new strict-mode tests pass.
• 17/17 existing autopopulate tests pass with strict default-off — confirms no regression.
• 8/8 trace + 9/9 cascade tests unaffected.

Test plan

• 6/6 new tests
• 17/17 default-off regression
• CI green after rebase onto master
• Manual: enable in a staging pipeline and verify legitimate `make()`s still run while violations raise with clear messages