feat(evidence): record provenance and stop derived evidence counting as corroboration

Every evidence row now records its derivation (direct, assertion, operator,
external, prediction, consolidation, inference, reflection, dream,
retrieval), its independent-source family (an actor, an integration, an
operator, a prediction) and its root event or memory ids. Confidence
groups evidence by family: the strongest primary item counts in full, each
further primary item adds a quarter, capped at 1.5x, and derived items
count only when the family has no primary member. Three derived
re-expressions of one utterance therefore weigh exactly what the utterance
weighs, while three independent families still add up.

Producers (conversation, association, consolidation, predictions,
metacognition, dreaming, operator and seed input, contradictions) supply
their ancestry. Existing rows are marked legacy_unknown with family =
source; nothing is invented. The belief page shows per-family
contributions and the replay test checks that provenance is reconstructed
identically in the sandbox. Migration 0017 is additive.

migrations/0017_evidence_provenance.down.sql

@@ -0,0 +1,6 @@
+DROP INDEX IF EXISTS belief_evidence_family_idx;
+ALTER TABLE belief_evidence
+  DROP COLUMN IF EXISTS provenance_status,
+  DROP COLUMN IF EXISTS root_ids,
+  DROP COLUMN IF EXISTS family,
+  DROP COLUMN IF EXISTS derivation;

migrations/0017_evidence_provenance.up.sql

@@ -0,0 +1,18 @@
+-- Evidence provenance (review pass §7.2 item 2).
+-- family: the independent-source key evidence is grouped by when confidence
+--         is computed (an actor, an integration, an operator, a prediction).
+-- derivation: how the row relates to its roots (direct, assertion, operator,
+--         external, prediction, consolidation, inference, reflection, dream,
+--         retrieval). Derived rows never add weight to a family that already
+--         has a primary member.
+-- root_ids: the originating event or memory ids this row ultimately rests on.
+-- provenance_status: 'recorded' for rows written with ancestry; existing rows
+--         are marked 'legacy_unknown' with family = source, never invented.
+ALTER TABLE belief_evidence
+  ADD COLUMN IF NOT EXISTS derivation text NOT NULL DEFAULT 'legacy',
+  ADD COLUMN IF NOT EXISTS family text NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS root_ids uuid[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS provenance_status text NOT NULL DEFAULT 'legacy_unknown'
+    CHECK (provenance_status IN ('recorded','legacy_unknown'));
+UPDATE belief_evidence SET family = COALESCE(NULLIF(source, ''), kind || ':' || ref_id) WHERE family = '';
+CREATE INDEX IF NOT EXISTS belief_evidence_family_idx ON belief_evidence (belief_id, family);