Track idle attribution provenance

[Air000000]

Scope

Completes the approved compact Idle attribution design on top of chore/harden-project-showcase without changing its core classification semantics.

Behavior

• keeps the existing candidate rule: app attribution is anchored to the foreground app at the last real user input, never the app visible when the user returns;
• keeps explicit confirmation: TimePrism never auto-attributes an idle interval to an app;
• keeps app attribution classification-neutral: Continue <App> preserves that app's existing LEARN / REST / IGNORE rule;
• keeps generic LEARN / REST / IDLE virtual-segment fallbacks when the user cannot reliably attribute the interval to an app;
• keeps the primary choice surface compact:
  • with a candidate: Continue <App> / Away / Other…;
  • without a candidate: Learn / Break / Away;
  • Decide later is a secondary text action rather than an equal-weight primary button in both the inline prompt and Focus Guard queue.

Provenance

app_usage_logs now stores explicit evidence source:

• FOREGROUND — observed foreground sampling;
• IDLE_CONFIRMED — a user-confirmed idle correction, including app attribution and generic Learn/Break/Away decisions.

Fresh schemas default new usage rows to FOREGROUND. Existing databases receive a one-time source migration; known historical idle virtual rows and Idle Confirmed · Previous App rows are backfilled to IDLE_CONFIRMED. Once the column exists, initialization does not rescan or reclassify historical rows.

Foreground segment coalescing now requires source equality, so a later observed foreground sample cannot erase the evidence boundary by merging into an adjacent user-confirmed segment.

TDD evidence

The first valid provenance RED reached runtime assertions after fixing an unrelated test-helper lifetime mistake:

• 51 tests: 46 passed / 5 failed;
• failures were exactly: fresh schema missing source, legacy schema missing source, generic idle written as foreground, app-attributed idle written as foreground, and foreground merging across an IDLE_CONFIRMED boundary.

After the minimum migration/write-boundary implementation, CI #133 passed.

A second RED pinned migration idempotency:

• 52 tests: 51 passed / 1 failed;
• the only failure showed an already-migrated database being reclassified on reopen.

The migration now returns immediately when the source column already exists.

Final verification

Current PR HEAD: 7567e02804dbffbe5dbe64e007bb2ea994dc1849

CI #137 passed on Windows:

• pnpm install --frozen-lockfile ✅
• pnpm run typecheck ✅
• pnpm run build:check ✅
• cargo check --all-targets ✅
• cargo test ✅
• Rust result: 52 passed / 0 failed

Known pre-existing warnings remain for unused ForegroundSnapshot in a foreground test import and unused Manager in lib.rs; this PR does not claim a warning-free build.

No independent GitHub review has been submitted yet.

Integration

This PR deliberately targets chore/harden-project-showcase, not main. It should only be folded into the parent hardening branch after explicit approval. Parent PR #2 remains Draft and still requires real Windows interactive smoke before any merge to main.