feat(plugin): serving_provenance on openai.exchange.v1 terminal event (stacked on #1437)

[StevenMih]

What

Surface the maximum inference provenance the host actually knows at serve time onto the openai.exchange.v1 terminal event — the stranger-promise / proof-of-inference metadata a downstream capsule attests over (advances Mesh-LLM#1233's digest advertisement): what ran, at what fidelity, on whose hardware, served by which node.

One new ServingProvenance struct, attached to the existing OpenAiExchangeEnvelope via a with_serving_provenance builder, populated at the raw-proxy dispatch callsite (network/openai/ingress.rs) from state the local mesh::Node already holds:

• Model fidelity (ServedModelMetadata): quantization, architecture, context_length, parameter_size, layer_count.
• Model identity (ServedModelIdentity): model_identity_hash (a digest of the model identity, not a hash of the name string), model_canonical_ref, model_revision.
• Hardware (node startup hardware survey): gpu, vram_bytes, is_soc, hostname.
• Topology: served_by_node_id (real serving iroh node id).

Honesty contract

Every field is Option + skip_serializing_if: a fact the host genuinely does not know is omitted, never fabricated. On a synthetic plugin-served endpoint with no loaded GGUF, hardware fields populate (host-wide survey) while model-fidelity fields are correctly absent. No raw prompt/response text — provenance only.

Stacking

Stacked on Mesh-LLM#1437 (mesh1331-lifecycle-hooks) — must land first; this PR targets that branch as its base. Clean addition: one struct + a builder + a small publish_raw_proxy_terminal helper, no refactor.

Tests

cargo build/test/clippy green on mesh-llm-host-runtime. New unit tests cover envelope carries-provenance / omits-unknown / effective-has-none. Proven end-to-end against a real mesh-llm serve on macOS (real gpu: Apple M4 Max, vram, soc, hostname, node id), captured into a signed capsule that agent-action-capsule verify --store accepts.

🤖 Generated with Claude Code

[StevenMih]

Pushed a cargo fmt fix (96ce5ec) — the Quality lane's rustfmt check was red on one line in openai_exchange.rs (a call rustfmt collapses to one line). No behavior change.

Verified locally (fork CI can't show the Linux/Quality lanes — private Docker image; see Mesh-LLM#1437): head 96ce5ec

• ✅ rustfmt
• ✅ repo-consistency:no-console-print
• ✅ repo-consistency:publish-crates
• ✅ repo-consistency:test-all-rust-crate-coverage