fix(research): enforce provenance digest and knowledge-time integrity

[Altairpaca]

Why

A repository audit found that the canonical research domain was weaker than the public provenance/no-hindsight contract: ResearchDocument duplicated provenance fields, did not validate text_sha256, and several research records relied on application-layer checks for known_at <= recorded_at rather than enforcing the invariant in the domain object itself.

What

• remove duplicate source_artifact_id / import_batch_id declarations and duplicate validation from ResearchDocument;
• validate and canonicalize research text SHA-256 digests at the domain boundary;
• enforce known_at <= recorded_at (or the persisted creation timestamp for links) across documents, claims, evidence, thesis revisions, contradictions and links;
• fail early when creating a thesis whose knowledge time is after its recorded time;
• add focused domain/service regression tests.

Deliberate boundary

This PR does not impose effective_at <= known_at globally. Existing Clausula temporal contracts consistently use known_at <= recorded_at, while effective-time semantics can require separate bitemporal review. That question should be decided explicitly rather than tightened incidentally during this repair.

Release sequencing

This is integrity remediation on the already implemented research layer. It does not activate the deferred AI workflow roadmap or merge #41.