Summary

• add hasna.agent_run_provenance.v1 for control-plane agent run provenance
• include task/project/repo/agent/run ids, prompt/model refs, auth profile refs, sandbox, approval policy, tool calls, cost, verifier result, commit/PR, artifact refs, provider health refs, and credential refs
• add valid/invalid fixtures and schema tests for reference-only fields and review-required verifier enforcement

Validation

• bun run typecheck
• bun test
• bun run conformance
• bun run build
• git diff --check
• staged secret-pattern scan over cached diff: no findings

Branch ordering

This branch is intentionally based on Worker 3's provider standard branch (missing-core/provider-comms-provider-standard at 88540da). Merge provider-standard first, then this provenance branch, or rebase if Worker 3 moves the provider branch.

No Co-Authored-By trailers.