fix(brain): provenance as a post-condition on every model-reachable write

The PR #147 review forged origin: static as a JWT principal through
three tools the first version never touched (brain_edit, brain_ingest_raw,
ingest_raw + brain_promote), and through YAML spellings a key-name match
missed (quoted, escaped, tagged, flow-mapped, merge keys, lone CR).

- api.StampProvenance removes every spelling of origin/written_by from
  the frontmatter and appends the real values. A line is dropped if
  EITHER yaml.v3 (decoding quotes, escapes, tags, flow maps) or the
  brain's line-oriented readers would read it as provenance; complex
  keys, orphan values and merge keys are dropped outright. Lone CRs in
  frontmatter become LF. Principal values that are not bare words are
  quoted.
- Applied as the last step of writeHallNote, UpdateNote, PromoteNote
  (re-attributed to the promoter), brain_edit (re-attributed to the
  editor) and both ingests (every page written or merged). REST
  /write and /promote carry no principal and stamp unknown.
- Ingest: newlines in scalar fields fold to spaces; a page type must be
  a plain lower-case name (../raw wrote outside wiki/, pre-existing).
- Audit: outcome is ok|error, never the error text, which echoed
  argument values.

Tests: every escape from the review is a table case asserting the
invariant on the file (parses as YAML, yaml.v3 and brain_get agree,
exactly the stamped lines). Plus REST /write, REST capture AuthPath,
body-line provenance in search, and quoted principals; two of the
review's surviving flips now go red. Three tests renamed so names claim
only what they assert.

Refs #145 #144

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/mcp/provenance_test.go

@@ -61,7 +61,7 @@ func TestBrainWriteWithoutPrincipalStampsOriginUnknown(t *testing.T) {
 
 // The control: a caller cannot claim a more trusted origin by putting it in
 // its own frontmatter.
-func TestBrainWriteOverwritesCallerSuppliedProvenance(t *testing.T) {
+func TestBrainWriteUnauthenticatedDropsPlainForgedProvenance(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	forged := "---\norigin: static\nwritten_by: local-cli\n---\n# F\n\nbody"
 	out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
@@ -76,7 +76,7 @@ func TestBrainWriteOverwritesCallerSuppliedProvenance(t *testing.T) {
 
 // brain_update replaces the content wholesale, so provenance follows the
 // last writer — and a forged fragment must not survive the merge either.
-func TestBrainUpdateRestampsProvenanceAndIgnoresForgedFragment(t *testing.T) {
+func TestBrainUpdateRestampsProvenanceToTheUpdater(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# U\n\nv1", "wing": "testing", "hall": "facts", "filename": "prov-update",
@@ -106,7 +106,7 @@ func TestBrainQueryReturnsProvenance(t *testing.T) {
 
 // capture is the door a claude.ai connector session uses, so it is the one
 // whose provenance matters most: a JWT principal must be stamped as such.
-func TestCaptureStampsJWTProvenance(t *testing.T) {
+func TestMCPCaptureStampsJWTProvenance(t *testing.T) {
 	srv, brainDir := captureServer(t, capFakeValidator{subject: "koala-cli"}, []string{"koala-cli"})
 	resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
 		"context":  map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "internal"},