feat(remediation): resolve source-owned GitOps provenance

[gnanirahulnutakki]

Summary

• add an immutable, versioned GitOps provenance bundle for one canonical GitHub source claim
• resolve only confirmed entity-local R2/R4 gitops.open-pr candidates against exactly one fresh workspace-matching bundle
• reuse the GitHub planner-owned pure canonicalization boundary and bind output to the exact live adapter/schema contract
• fail closed on ambiguity, staleness, cross-workspace attachment, handler drift, target/output mutation, cancellation, and expiry

Authority boundary

Ready means provenance-complete, not authorized. This change adds no actor, role, server intent ID, credential, PEP call, approval, persistence, network, Git operation, dispatch, mutation, or execution path. F14.6 and E14 remain open for the authenticated Hub-to-PEP composition and live canonical read adapter.

Proof

• focused race tests repeated 20 times; resolver fuzzed for 50,000 executions
• make ci (format, vet, lint, govulncheck, all race/e2e/policy/perf/build gates)
• make e2e-isolation (PostgreSQL 18.4 forced RLS + two 50,000-execution workspace fuzzers)
• make release-check (dual reproducible four-platform builds, SPDX SBOMs, formula, amd64/arm64 OCI)
• make e2e-kind with pinned Kubernetes 1.36.1 in 243.913s; clean teardown
• three whole-diff CodeRabbit passes; final pass zero findings

Security and cost

The resolver is pure and offline. It adds no cloud resource, API call, egress, storage, telemetry cardinality, or recurring cost. A future live provenance adapter owns credential custody, GitHub rate limits, egress, and remote freshness.

Closes #301

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dd1fcef3-d90d-44d1-b152-71c13ca2528d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/gitops-provenance-20260722

---

_{Comment @coderabbitai help to get the list of available commands.}

[gnanirahulnutakki]

Review clarification: the hosted CodeRabbit bot skipped automatic review because this repository targets dev rather than the default branch. The complete nine-file diff was reviewed locally with authenticated CodeRabbit CLI three times. The first pass found two documentation omissions, both fixed; a later manual trace found and fixed final cancellation/expiry rechecks; the final post-hardening CodeRabbit pass reported zero findings. Hosted CI, release reproducibility, and all three CodeQL analyses are green on exact signed head e91af76468eb45b9e6f1f6c1bc5e6b67d5cf13c7.