test: record checkout provenance in DFG Re20 receipts

plan.json and result.json now carry HEAD, the dirty flag, the src tree
hash and the runner hash, labelled current_checkout; result.json is
refused if the checkout changed during the run. Numerics, sampling and
the frozen steady rule are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/test_dfg_re20.py

@@ -75,5 +75,15 @@ class Re20Contract(unittest.TestCase):
         self.assertEqual((out["status"], out["verdict"]), ("INCOMPLETE", None))
 
 
+class Re20Provenance(unittest.TestCase):
+    def test_records_current_checkout(self):
+        record = v.provenance(rr.DEFAULT_SOURCE)
+        self.assertEqual(record["source_mode"], "current_checkout")
+        self.assertEqual(len(record["checkout_revision"]), 40)
+        self.assertEqual(len(record["src_tree"]), 40)
+        self.assertEqual(len(record["runner_sha256"]), 64)
+        self.assertIn("checkout_dirty", record)
+
+
 if __name__ == "__main__":
     unittest.main()