Result provenance contract

Every result generated by a Calibrex pipeline carries a versioned run.provenance contract (slac.result.provenance/v0.1). The required fields identify the producer, tool name/version, generation timestamp, recorded command, configuration SHA-256, and input SHA-256. A missing git commit or digest is represented by an explicit *_unavailable_reason; Calibrex never invents a value.

The shared build_result_provenance(...) helper is the only supported way for result generators to create this metadata. CalibrationResult.save() and the calibrex validate --kind result boundary validate the contract. A result with an incomplete new contract is blocked rather than downgraded to a warning.

Legacy v0.1 files

Historical slac.result/v0.1 files may contain an unstructured or empty provenance map. load_result() keeps these files readable without adding ambient clock, git, config, or input metadata. Such an object is marked provenance_status == "legacy", remains production_valid == False, and cannot be saved through the new boundary unless allow_legacy=True is passed explicitly. validate --kind result reports admissibility: blocked and the specific provenance issues.

Migration is explicit: load the legacy file, supply the real producer/tool, command, timestamp, commit (or unavailable reason), and config/input digests to build_result_provenance(...), assign the returned mapping to result.run.provenance, then save it. Do not copy ambient values into a legacy file merely because it was loaded.