feat(agent): add decision snapshot provenance fields

[JSONbored]

Parent roadmap: #127
Parent phase: #269
Parent epic: #270

Goal

Add source and freshness metadata to decision snapshots so contributors can understand what evidence was used without exposing private context.

Requirements

• Capture public-safe source identifiers, freshness, confidence inputs, and known evidence gaps.
• Distinguish public-safe provenance from private/authenticated provenance in the snapshot model.
• Keep raw source upload fail-closed and avoid storing local source contents.

Acceptance criteria

• Snapshot provenance shows source/freshness/confidence metadata for supported recommendation paths.

• Private/authenticated fields are never serialized into public GitHub text.

• Missing or stale evidence is represented explicitly instead of silently omitted.

• This is advisory metadata only, not public scoring or reward prediction.

• This is not an autonomous PR bot and not public scoring.

Validation expected

• Provenance fixture tests for fresh, stale, missing, and private evidence.
• Public/private serializer tests.
• npm run test:ci.