feat(runtime): bind role-profile provenance

[Punisheroot]

Summary

Bind each new runtime session to one immutable active role-profile revision and propagate its bounded provenance through worker execution, cache identity, change attempts, and lifecycle audit records.

Closes #3.

Implementation

• Adds an additive SQLite migration for role-profile provenance on sessions, worker runs, change requests, and change attempts.
• Freezes profile ID, revision, and definition digest transactionally at session start, rejecting conflicting retries.
• Resolves the exact historical revision when constructing WorkerConfig; later activation affects only new sessions.
• Includes provenance in full and logical cache identities and rejects unknown or inconsistent cache entries.
• Propagates provenance through worker success/failure/recovery, patcher/verifier attempts, MCP observations, cancellation, and change/apply lifecycle events.
• Keeps legacy rows unattributed and fail-closed.
• Redacts change failure details to a bounded classification and digest.
• Requires an explicit role-profile selector for MCP and product-hook sessions.
• Updates offline and experimental session entry points to avoid creating new legacy sessions.

Validation

cargo check --locked --workspace
passed

cargo test --locked -p needle-core
59 passed

cargo test --locked -p needle-runtime
109 passed

cargo test --locked -p needle-platform-codex --test offline_n1
6 passed

cargo test --locked -p needle-platform-codex --test patcher_offline
3 passed

cargo test --locked -p needle-platform-codex --test main_interrupt
14 passed

cargo test --locked --workspace
passed; one pre-existing ignored test

cd crates/needle-app/web
npm ci
npm run build
passed

git diff --check
passed

No Codex or provider calls were made. Web E2E was not run because web serialization was unchanged.

Risks/limitations

• Migration V15 is additive and intentionally leaves historical rows with unknown provenance.
• Role-profile provisioning and editing remain outside this change; callers must select an already active revision.
• Hooks without a valid NEEDLE_ROLE_PROFILE_ID remain fail-open but record no session, preventing false attribution.
• npm ci reports three high-severity dependency advisories; this pull request does not modify web dependencies or the lockfile.
• No performance improvement is claimed; the added work is bounded SQLite lookup and digest material.

Documentation/evidence

Updated:

• docs/CONFIGURATION.md
• docs/DEVELOPER_SETUP.md
• docs/MCP_TRANSPORT.md

AI assistance and human verification

AI assistance: code only. AI was used only for code assistance.
Human verification: I reviewed the complete diff against issue #3, checked session and change immutability, historical revision resolution, cache separation, legacy fail-closed behavior, provenance redaction, production and experimental entry points, and personally verified the reported Rust and web validation results.

Ownership checklist

• I read and understand the complete diff and can explain every material change.
• I personally verified the reported tests and technical or performance claims.
• I finalized and personally published the commits and this pull request.
• I checked for unrelated edits, credentials, generated files, and live artifacts.
• Public documentation and PROJECT_STATUS.md are updated when applicable.