feat: show certified local build provenance and runtime drift

[Nowaker]

Summary

Follow-up to merged #866, tracked in #1170.

• Certify successful local artifact builds with a persisted, worktree-scoped counter. The display identity includes the actual reachable release base, counter, branch, short commit and dirty state. Source execution is explicitly counter-free.
• Freeze runtime provenance at startup. Add authenticated, local/dev-only GET /build-status to compare it with independently observed disk output, including exact N builds behind, rollback, source changes and unavailable evidence.
• Render provenance and safe origin-derived branch/commit links in the shared header. Keep npm's current/update behavior unchanged and never poll the new endpoint for npm installs.

Correctness boundaries

• Counters represent successfully certified artifacts, not commits or source edits. The ledger survives deletion of dist; separate worktrees have incomparable counter scopes.
• An embedded attempt identity must match the manifest, committed success record and artifact inventory. Failed gates/publication do not consume a successful counter. Uncertified output never acquires a guessed counter later.
• Request handling reads a single-flight cache. Filesystem/Git verification runs in a bounded worker at most once per ten seconds on demand, not on the streaming event loop or in an idle polling loop.
• Builder claims recover confirmed dead owners without age-based lock stealing. Readers do not create locks or write into a parent repository.
• Release ancestry, package version and registry latest remain distinct. Unsupported origins produce no link; supported links discard credentials, query strings and fragments.
• Git-less archives keep their prior metadata behavior. Source runs retain a frozen startup snapshot but never pretend to be completed builds.

Validation

• npm run typecheck: passed.
• npm run build: passed, including the bundled Node observation worker and existing entrypoint/declaration checks.
• Focused provenance/header tests: 91 passed; isolated health/auth contract tests: 9 passed.
• Retained node scripts/e2e-build-provenance.mjs: passed against the real bundled Node HTTP server. Runtime build chore(main): release 1.0.2 #8 remained immutable while three actual successful builds advanced disk to 60s cooldown on concurrent calls #11; endpoint reported buildsBehind: 3; 30 concurrent cached requests returned 200.
• Real Chromium fixture QA: 217/217 checks; current/behind/rollback/source/unknown/failure, safe links, focus preservation, non-overlapping polling, npm no-poll, and header/landing layouts at 375/768/1280 pixels. No horizontal overflow or JavaScript errors. Both independent visual-review passes approved all 45 fresh captures on f3fc5c1.
• Independent review found and corrected synchronous polling work, stale-lock recovery, reader/build contention, counter publication order, a Windows TypeScript invocation regression, and parent-repository adoption. Goal/code/security recheck passed; QA drivers verified the fixes.

Explicit remaining evidence

• Final-head GitHub CI on f3fc5c1068580652978bd4fd1908019da5532c56: 10 successful, 2 skipped, 0 failing. Includes test (6m2s), windows-smoke (1m33s), Docker smoke/build, Linux/macOS Nix builds, Linux/macOS desktop builds, and dependency availability/lock verification.

• Full npm test is not green on this host. Both candidate and untouched upstream/main runs exceeded the 20-minute limit in session-lifecycle tests. A targeted untouched-upstream run reproduced four idle-ceiling, busy-session fork and extra-usage timing failures (20 pass / 4 fail). No tests were removed or weakened to mask these failures; required CI remains a merge gate.

• Windows invocation was corrected and the final-head Windows smoke CI passed; no separate interactive Windows verification was performed.

• No production/shared service was changed. Live meridian-dev deployment/browser verification awaits the owner's decision whether to keep direct Bun source execution or switch to a numbered built Node artifact, then a coordinated restart window. Isolated compiled HTTP and browser-fixture verification above is complete; it is not substituted for that pending deployment check.

• This change does not release or publish Meridian and does not include PR feat(profiles): complete a profile login from the web UI #792.