test: explicitly repin validation to reviewed channel source

tests/validation/source_provenance.py

@@ -0,0 +1,15 @@
+"""Record runtime checkout identity separately from the reviewed source origin."""
+
+import subprocess
+
+
+def checkout_provenance(repo):
+    """Require a Git checkout; never label changed-source runs as historical evidence."""
+    revision = subprocess.check_output(
+        ["git", "-C", str(repo), "rev-parse", "HEAD"], text=True
+    ).strip()
+    dirty = subprocess.check_output(
+        ["git", "-C", str(repo), "status", "--porcelain", "--untracked-files=normal"],
+        text=True,
+    )
+    return dict(checkout_revision=revision, checkout_dirty=bool(dirty))