test: check pinned source manifests against their own commits

Historical-evidence pins (dfg_re100 / jet_circle_cv / refined_dfg manifests)
now compare each recorded digest with the file at the recorded commit, read
with git, instead of with today's working tree. Missing history (no git,
shallow clone, installed copy) raises HistoryUnavailable and the test is
reported as skipped with that reason, never passed. Receipt/plan logic tests
take the selected manifest directly, so their assertions run again; the
pinned modes' mismatch rejections stay as negative controls.

V1 (run_jet_circle_cv) keeps its pinned mode and gains --current-checkout:
it records HEAD, the src tree and per-file hashes labelled as current
checkout, never as the frozen qualification, and requires a clean tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/test_jet_circle_cv.py

@@ -166,7 +166,34 @@ class Host(unittest.TestCase):
         self.assertEqual(a["steps"] * 4, b["steps"])
 
     def test_source_pin(self):
-        verify(REPO)
+        """Historical integrity: the manifest matches its pinned commit, read with git."""
+        from run_jet_circle_cv import verify_historical
+        from source_provenance import HistoryUnavailable
+        try:
+            verify_historical(REPO)
+        except HistoryUnavailable as error:
+            self.skipTest(f"historical integrity NOT checked: {error}")
+
+    def test_pinned_mode_still_rejects_changed_source(self):
+        """Negative control: the frozen-source guard refuses a tree that differs from PIN."""
+        import json
+        import run_jet_circle_cv as v
+        manifest = json.loads((v.HERE / "data/jet_circle_cv/source_manifest.json").read_text())
+        import hashlib
+        current = {f: hashlib.sha256((REPO / f).read_bytes()).hexdigest()
+                   for f in manifest["files"] if (REPO / f).exists()}
+        if current == manifest["files"]:
+            self.skipTest("working tree equals PIN; no changed source to reject")
+        with self.assertRaisesRegex(RuntimeError, "Source hash mismatch"):
+            verify(REPO)
+
+    def test_current_checkout_provenance(self):
+        from run_jet_circle_cv import current_checkout
+        record = current_checkout(REPO)
+        self.assertEqual(record["source_mode"], "current_checkout")
+        self.assertIn("not the frozen", record["source_capture"])
+        self.assertEqual(len(record["src_tree"]), 40)
+        self.assertTrue(record["src_sha256"])
 
 
 if __name__ == "__main__":