Build Week: Preserve cross-agent correlation IDs in Argus findings

[CodeBuildder]

Objective

Preserve an explicit Sentinel correlation ID when Argus publishes accepted Falco evidence to the Sentinel Operations Graph.

Scope

• Accept correlation_id from the webhook envelope or normalized Falco fields.
• Forward it unchanged in the SOG finding contract.
• Mark native Falco evidence as observed provenance.
• Keep correlation optional so ordinary standalone findings remain valid.
• Add contract tests.

This is the Argus producer portion of CodeBuildder/sentinel#52.

Acceptance criteria

• Explicit IDs survive Argus → SOG publishing unchanged.
• Missing IDs do not fabricate an incident relationship.
• Existing idempotency and failure-isolation behavior remains intact.
• Agent tests pass.