feat: record Chongqing extraction provenance boundary

[zhouning]

Summary

• add M3-29 metadata-only extraction provenance evidence for the Chongqing source
• bind the evidence to the immutable M3-28 admission fingerprints and comparison counts
• record six missing derivation inputs: operator, tool version, command digest, modified-entry manifest, additional-entry manifest, and archive-to-working-set attestation
• add CI and staging required-test gates plus ADR-076 and System-of-Record updates

Authority boundary

This PR records comparison_observed=true and derivation_provenance_complete=false. It contains no source payload, absolute path, row value, geometry, or credential. It does not authorize content admission, Landing, ResourceVersion, PlatformRun, scheduler submission, provider mutation, production ingestion, or production readiness.

Verification

• 27 local CI validators passed
• 702 required platform tests passed
• 27 focused and parity tests passed
• git diff --check passed

This PR continues the mainline work from PR #96.