fix: require own download provenance

[0thernet]

Summary

• require each Chrome download completion to prove its own UUID-scoped partial-file lineage by matching device and inode identity
• reject first-seen, unrelated, mutated, disappeared, cross-run, conflicting, aborted, retried, and quota-exceeding provenance states fail closed
• preserve the direct same-inode rename fast path and ship the canonical generated tooling bundle

Validation

• canonical local bun run check completed successfully on the exact source, test, and generated bundle blobs
• typecheck, lint, 406 source tests with 71,292 expectations, 22 immutable npm-recovery tests, package smoke, Todo boundaries, and React Native boundaries passed
• package smoke: 243,793 packed bytes, 1,166,221 unpacked bytes, 60 files
• current-main reconciliation advanced only AGENTS.md and CLAUDE.md; package.json, bun.lock, and all three candidate blobs remained byte-identical
• git diff --check passed and two independent static reviews approved the final three-file scope

Exact candidate commit: fc92728
Exact base: e835ba1