test: tighten historical-pin checks per review of 941eb28b

- test_refined_dfg::test_source_pin runs its mismatch negative controls
  first (now including window mode) so missing history cannot skip them.
- test_re100: renamed to test_manifest_matches_its_pinned_commit, plus an
  explicit record that today's src differs from the pin.
- Structural manifest checks run before any history-dependent check.
- Real tamper test: a flipped digest raises via verify_manifest, and a
  path absent at the commit raises ValueError.
- A blobless clone (tree present, blob missing) is reported as unavailable
  history, not as a missing path.
- All history skips go through history_unavailable(): fatal when
  CELERIS_REQUIRE_HISTORY=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/test_re100.py

@@ -62,17 +62,31 @@ def test_periodic_synthetic():
     assert not p.assess(rows()[:100])["periodic"]
 
 
-def test_production_unmodified():
+def test_manifest_matches_its_pinned_commit():
+    """Historical integrity only: the manifest describes the h.PIN tree (read with git)."""
     m = json.loads(
         (ROOT / "tests/validation/data/dfg_re100/source_manifest.json").read_text()
     )
     assert m["commit"] == h.PIN
-    from source_provenance import HistoryUnavailable, historical_sha256
-    try:  # the manifest certifies its own commit, not today's working tree
-        actual = historical_sha256(ROOT, m["commit"], m["production_sha256"])
+    import unittest
+    from source_provenance import HistoryUnavailable, history_unavailable, verify_manifest
+    try:
+        verify_manifest(ROOT, m["commit"], m["production_sha256"])
     except HistoryUnavailable as error:
-        pytest.skip(f"historical integrity NOT checked: {error}")
-    assert actual == m["production_sha256"]
+        history_unavailable(unittest.TestCase(), error)
+
+
+def test_current_src_is_not_the_pinned_qualification():
+    """Explicit record: today's src differs from h.PIN, so its qualification does not carry over."""
+    m = json.loads(
+        (ROOT / "tests/validation/data/dfg_re100/source_manifest.json").read_text()
+    )
+    changed = sorted(n for n, d in m["production_sha256"].items()
+                     if not (ROOT / n).exists()
+                     or hashlib.sha256((ROOT / n).read_bytes()).hexdigest() != d)
+    if not changed:
+        pytest.skip("current src equals the pinned tree")
+    assert changed  # e.g. src/CelerisLab/lbm/channel.py since 47b05bc
 
 
 def test_reference():