Fail closed on legacy cache provenance

[farach]

Summary

• fail closed when receiptless or legacy-unverified archive and adapter caches receive URL, version, as-of, or SHA-256 constraints
• preserve warning-only fully unconstrained legacy reuse without asserting unknown provenance
• redact URL credentials and query values while retaining an opaque URL identity for mismatch detection
• keep force refresh atomic and update installed showcase fixtures to seed explicit verified receipts

Validation

• devtools::test(): 715 passed
• rcmdcheck::rcmdcheck(args = "--as-cran"): 0 errors, 0 warnings, 1 expected new-submission note
• Rscript tools\validate-clean-install.R --rounds=2: passed both rounds
• installed-package tests with network blocked: 708 passed, 6 CRAN skips
• pkgdown::check_pkgdown() and full site build: passed; 87 HTML files checked for broken O*NET rendering
• both workflow YAML files parsed successfully

Stacked from 9c179af9b17163ba7eee7bec972a732b6b56b0b0 and targets farach-harden-release-gates.

[farach]

Superseded by the reviewed fixes already integrated into parent PR #18 (abb694b/a20e32b/522b092). No branch deleted.