Record effective guard state in campaign provenance

[slowdini]

Summary

• Record the post-preflight guard_armed value in conditions.json.
• Derive dispatch.json.guard from that recorded value and carry it into benchmark.json.
• Render the effective state as true, false, or unknown in promoted BASELINE.md files.
• Document and test guarded, explicitly unguarded, unstaged, guardless, and historical runs.

Rationale

Published benchmark and baseline provenance names the harness, model, codebase, and skill, but did not say whether the eval guard was active. This makes that validity boundary explicit while leaving enforcement authority and expanded per-task policy in dispatch.json.

Artifact contract

Before:

{
  "harness": "codex"
}

After:

{
  "harness": "codex",
  "guard_armed": true
}

Historical conditions without the field remain readable. Their benchmark omits the field, and promotion renders Guard armed | unknown; absence is not treated as false.

Implementation notes

• ConditionsRecord.guard_armed and Benchmark.guard_armed are optional for compatibility, but every newly prepared iteration records true or false.
• run --help and eval-magic docs guard describe the provenance contract.
• RunArgs and the new provenance tests moved to focused modules to keep their long owner files navigable.
• No CLI flag or guard-enforcement behavior changes.

Verification

• cargo fmt --check
• cargo build
• cargo test --quiet (953 library, 218 CLI, and 208 run tests)
• cargo clippy --all-targets -- -D warnings
• git diff --check

Closes #306