Freshness: decide who writes verifying-trace rows for paces' evidence #24

The evidence layer (#4) writes was_derived_from edges on every annotation, and tests/test_evidence.py::test_lineage_edges_resolve asserts the graph is connected with no dangling refs. That is what nw.freshness.stale_after needs to walk the graph — but not what it needs to call anything verified fresh.

nw reads verifying-trace rows for that, and paces writes none. So today:

• "what is downstream of this changed annotation" → answerable (the edges resolve).
• "is this artifact verified fresh" → nw reads nothing, so nothing is verified.

That gap is fine for #4's scope — nothing in paces consumes nw yet, and ADR-0004 keeps nw out of the dependency set. It becomes real when paces/genre.py registers step_by_step into nw (the ADR-0004 next step), because that is the point where prepare → plan → execute starts asking freshness questions about paces' rows.

What this issue is for: decide, at that point, whether paces writes verifying-trace rows itself or whether the genre registration does it on paces' behalf. Whichever it is, the test's docstring in tests/test_evidence.py should stop hedging and point here.

Not blocking anything today. Raised in review of #23 (nit 6) so the distinction between "edges resolve" and "nw-fresh" is written down rather than assumed.