fix(api): validate the merged envelope on supersede, not the caller's fragment

Review caught a real bypass in the #111 fix before merge: the previous
commit validated only the frontmatter fence the caller supplied, not the
merged result that actually reaches disk. A caller could blank
claim_provenance alone (absent per claim.present's "empty is unset" rule)
while half_life/applies survived untouched from the prior note — each side
individually looked fine, the merged envelope on disk was the
unprovenanced one the whole check exists to catch. That's the exact
laundering #111 named as the worse of its two gaps.

Fixed by computing the envelope from fm (post-merge, pre-write) instead of
contentFM (the caller's raw fragment). Flip-tested: reverting to
fragment-only validation turns the new adversarial test red; the merged
validation turns it green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ingestion/internal/api/update_test.go

@@ -112,6 +112,29 @@ func TestUpdateNoteAcceptsValidEnvelopeAndMergesIntoFrontmatter(t *testing.T) {
 		"exactly one open+close fence pair — the caller's own fence must not leak in as a second, inert block")
 }
 
+func TestUpdateNoteRejectsClearingProvenanceWhileEnvelopeSurvives(t *testing.T) {
+	// Found in review, not written speculatively: validating only the
+	// caller's fragment (rather than the merged result) let a caller blank
+	// out claim_provenance alone while half_life/applies survived from the
+	// prior note untouched — each side looks fine on its own, the merged
+	// envelope on disk is the unprovenanced one the whole check exists to
+	// catch.
+	brainDir := t.TempDir()
+	original := "---\nwing: jepa-fx\nhall: facts\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\nold\n"
+	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
+
+	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
+		Path:    rel,
+		Content: "---\nclaim_provenance: \n---\nnew body\n",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "claim envelope")
+
+	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
+	require.NoError(t, err)
+	assert.Equal(t, original, string(got), "rejected update must leave the note byte-identical")
+}
+
 func TestUpdateNoteWithoutEnvelopeFieldsIsUnchangedFromToday(t *testing.T) {
 	// Regression pin: plain fence-less content (the common case) must behave
 	// exactly as it did before the envelope-merge fix.