test: tighten historical-pin checks per review of 941eb28b

- test_refined_dfg::test_source_pin runs its mismatch negative controls
  first (now including window mode) so missing history cannot skip them.
- test_re100: renamed to test_manifest_matches_its_pinned_commit, plus an
  explicit record that today's src differs from the pin.
- Structural manifest checks run before any history-dependent check.
- Real tamper test: a flipped digest raises via verify_manifest, and a
  path absent at the commit raises ValueError.
- A blobless clone (tree present, blob missing) is reported as unavailable
  history, not as a missing path.
- All history skips go through history_unavailable(): fatal when
  CELERIS_REQUIRE_HISTORY=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validation/source_provenance.py

@@ -34,15 +34,28 @@ def historical_sha256(repo, commit, paths):
         raise HistoryUnavailable(f"commit {commit} is not available in {repo}") from error
     digests = {}
     for path in paths:
-        try:
-            blob = subprocess.run([*git, "show", f"{commit}:{path}"], check=True,
-                                  capture_output=True).stdout
-        except subprocess.CalledProcessError as error:
-            raise ValueError(f"{path} is not part of {commit}") from error
-        digests[path] = hashlib.sha256(blob).hexdigest()
+        listed = subprocess.run([*git, "ls-tree", "--name-only", commit, "--", path],
+                                capture_output=True, text=True)
+        if listed.returncode:
+            raise HistoryUnavailable(f"tree of {commit} is not available in {repo}")
+        if listed.stdout.strip() != path:
+            raise ValueError(f"{path} is not part of {commit}")
+        shown = subprocess.run([*git, "show", f"{commit}:{path}"], capture_output=True)
+        if shown.returncode:  # e.g. a blobless partial clone without network access
+            raise HistoryUnavailable(f"content of {path} at {commit} is not available in {repo}")
+        digests[path] = hashlib.sha256(shown.stdout).hexdigest()
     return digests
 
 
+def verify_manifest(repo, commit, digests):
+    """Raise RuntimeError naming the first path whose recorded digest differs at `commit`."""
+    actual = historical_sha256(repo, commit, digests)
+    for path, digest in digests.items():
+        if actual[path] != digest:
+            raise RuntimeError(f"Historical manifest mismatch at {commit}: {path}")
+    return actual
+
+
 def historical_tree(repo, commit, prefix="src"):
     """Tracked file names under `prefix` at `commit` (HistoryUnavailable if missing)."""
     historical_sha256(repo, commit, [])