Carry source revisions in proposition provenance

[jimador]

Summary

Carry an optional opaque source revision through extraction, stored provenance, tenant-scoped queries, REST/discovery surfaces, collector fold/undo, and JSON without changing source locator identity.

Source revision is intentionally distinct from extraction-run lineage: SourceRevisionRef(sourceKey, sourceRevision) identifies one logical source version, while run metadata continues to identify the analysis execution.

Compatibility boundary

• Preserves existing Kotlin and Java source compatibility.
• Preserves the accepted old Java constructor arities and existing public method descriptors with executable interop checks.
• Keeps legacy JSON readable and makes source revision additive; existing public trace locator values remain readable and retain their legacy meaning.
• Preserves stored revisionless provenance and lazily adopts exact legacy graph edges when revisionless data is rewritten.
• Does not claim full Kotlin synthetic constructor/copy binary ABI compatibility; that boundary remains explicitly out of scope.

Behavior

• Adds tenant-scoped queries for all source versions, an exact revision, and revisionless-only provenance.
• Keeps SourceLocator.key() stable and stores revision as a scalar on existing source evidence.
• Uses revision-distinct Drivine relationship identity, with exact legacy-edge adoption and retry-safe race recovery.
• Preserves revision-distinct evidence through collector fold/undo while retaining legacy trace values for consumers.
• Round-trips source revision through canonical proposition JSON, REST, and discovery DTOs.

Review fixes

The issue was that a few edge paths could reuse the wrong source, partially mutate an undo, or leave compatibility and query-plan behavior asserted indirectly. The fix validates source identity before dedup reuse, resolves both undo participants before writing, proves persisted replay cardinality, pins an executable old-client binary fixture, and couples plan checks to the production query invocation.

Validation

• ./mvnw verify — all seven Dice modules passed (1,246 Dice tests and 110 storage tests).
• Me downstream extraction, ingestion, storage-guard, and unmerge suite — 40 passed.
• Live Me startup from .env succeeded; health is UP and James's read-only Discord handler returned HTTP 200 with an empty result using a future cursor.
• No database migration is required.
• No experimental API markers are added.

Refs #64. The remaining bundle integration gate waits on #46 and is not required for this PR's core source-revision behavior.