Add trusted resume with explicit provider and model transition lineage

[Gongyl01]

Problem Statement

Part of #368

ocr review --resume currently validates the review mode and raw ref strings, then reuses completed checkpoints whose per-file diff fingerprints still match. Changed, failed, or missing items are dispatched again.

However, it does not validate the resolved commits, the complete selected input set, repository identity, provider/model transition, or review-rule identity. A resumed result can therefore combine reused checkpoints and newly executed work even when the overall run identity has changed. Fully failed parent runs are also rejected before they can resume because they contain no completed checkpoint.

Proposed Solution

1. Validate the complete run identity before reuse

• Before reusing any checkpoint, compare the parent and child source_artifact_sha256 using the Emit a complete immutable review manifest and partial-coverage contract #367 algorithm, SHA-256(sorted[(item_id, fingerprint)]), together with input mode, repository identity, and review-rule identity (rule_config_sha256).
• Any mismatch rejects the whole resume with zero checkpoint reuse, and fails before run creation: no child run, session, or manifest is persisted.
• Raw-ref string comparison is removed in favor of the resolved-identity comparison, so equivalent spellings such as abc1234 and abc1234def no longer reject a resume.
• The parent manifest remains immutable; an accepted child run creates its own manifest under the same input identity.

2. Partition reusable and pending work

• Only completed or previously reused checkpoints that are readable and whose fingerprints agree with the parent manifest become reused in the child run.
• Failed, incomplete, missing, or corrupted checkpoints are dispatched again.
• A fully failed parent run remains resumable, in which case every selected item is dispatched again.
• Replayed comments are merged into output only and are not inserted into a new LLM context.

3. Require explicit provider/model transitions and record lineage

• A provider change is accepted only when the resuming command explicitly supplies --provider; a model change under the same provider is accepted only when it explicitly supplies --model.
• Changes caused only by configuration files or environment variables are implicit transitions and are rejected.
• An accepted resume writes one resume_lineage session event with schema ocr.resume-lineage/v1, recording the parent and child run IDs and the source/target provider and model. The transition kind follows from comparing source with target, and configuration changes are already carried by the manifest's runtime_config_sha256, so neither is stored again.
• Reused, completed, and remaining coverage comes from the child ocr.run-manifest/v1; the lineage event does not duplicate coverage.
• The lineage event does not contain credentials, complete endpoints, local paths, diffs, prompts, or model responses.

Acceptance criteria

• Same-provider, same-model resume validates the complete input identity before reuse and dispatches only failed, incomplete, missing, or corrupted work.
• A fully failed parent run can resume and dispatches all selected items.
• A changed source artifact, input mode, repository identity, or review-rule identity rejects the entire resume with zero checkpoint reuse and no persisted child run, session, or manifest.
• Ref spellings that resolve to the same input are accepted rather than rejected.
• Provider/model changes are accepted only through explicit flags on the resuming command and are recorded in one lineage event.
• Reused comments affect final output but do not enter a new LLM context.
• The child manifest remains the only source of coverage truth; every selected item still has exactly one terminal coverage outcome.
• Legacy, aborted, manifest-less, workspace, or unknown-schema parents are rejected with a clear instruction to start a new review.
• Tests cover same-provider resume, fully failed parents, explicit and implicit provider/model transitions, changed-input and changed-rule-config rejection, equivalent-ref acceptance, corrupted checkpoints, reused-comment isolation, and legacy/unknown-schema rejection.

Dependencies

• This issue builds on ocr.run-manifest/v1 from Emit a complete immutable review manifest and partial-coverage contract #367 and modifies neither its schema, its FailureClass values, nor its terminal-state formula.
• One behavior regression is intentional. A parent session without session_end — including any run interrupted by Ctrl-C — can no longer resume, because the parent manifest is written only in that record. The current implementation reads checkpoint lines alone and does resume such runs. Verifiability is preferred over resuming parents that cannot be verified.

Out of scope

• SDK retry behavior, backoff, and provider concurrency budgets.
• Automatic provider selection, ranking, or implicit failover.
• Workspace resume, scan resume, or multiple-parent resume.
• Changes to the ocr review --format json envelope; lineage is persisted and exposed through session inspection surfaces.