core: sync_apply decodes feed manifest bytes as AssetManifest, but the feed serves provenance-record bytes

[justin13888]

What

capsule_core::lifecycle::sync_apply (capsule-core/src/lifecycle/sync_apply.rs, around the from_slice::<AssetManifest> call) decodes a feed entry's manifest_cbor as an AssetManifest. The feed serves the provenance blob's bytes unchanged (capsule-server/src/routes/sync.rs), and the provenance blob a correct client uploads is the canonical CBOR of the chain head ProvenanceRecord — the only encoding whose digest equals record_hash() and therefore the only one under which lifecycle ops chain (see the sibling SDK issue on the missing provenance rung). A record wraps the manifest with its chain position, so the decode fails on every correctly pushed asset.

Evidence

Found while landing capsule-e2e (#409, PR #463). E2E case 2 asserts entry.manifest_cbor == to_canonical_vec(head_record) end to end; a second device applying that entry through sync_apply would refuse it as malformed.

Fix shape

Decode the bytes as ProvenanceRecord (and verify record.mirrors_manifest()), taking the AssetManifest from record.manifest; or define one wire encoding in design/provenance.md and make the SDK, the server head computation and sync_apply agree on it.