v3.18.1 — guard the knob, unpublish the provenance file

Guards for the class of bug 3.18.0 fixed, and one file that should never have been public.

Added — tests/python/test_knob_audit.py. Every knob that moves a number must move only the columns it is documented to move. Seven loci on purpose: a TRB-only fixture cannot see a reference that covers TRA and TRB and leaves five loci of diversity as holes, which is the case that used to raise KeyError. Mutation-checked — a partial cstar dict borrowing another locus's level, cstar_fallback_frac hard-coded to 0, and the coverage level leaking into vsig:len each fail the suite.

At cohort scale on 40 seven-locus samples: the flat C* = 0.20 → measured C* = 0.1072 moves 992 cells, 18.14% of the matrix, across 29 columns; a TRA/TRB-only reference turns 800 of 1,120 vsig:div cells into declared holes with 200 estimable flags going to 0. Before 3.18.0 the first was silent and the second was an exception.

Removed — SOURCES.md is no longer tracked. It is the one markdown file whose purpose is internal detail: cluster project paths, private HuggingFace dataset names, local checkout locations, cohort composition down to batch names and HLA schemas. It was already excluded from the sdist; it is gitignored now too, and bundled.py, convert.py and SKILL.md point at the per-artifact manifest.json instead.