Q1: digest-bearing search receipts, implemented additively (gated on M0)

[joefeser]

Gated on #105 (M0) landing first.

Context

Audit finding F1 (v2, confirmed): search/related/provenance receipts omit source_record_set_digest, so query evidence is unpinnable, and the digest is unreachable from the CLI (no metadata command). WITS 1151 closeout was verified to require digest binding — required, not narrowed. The independent second opinion ruled digest-in-receipt squarely inside Artifact Memory and required by WITS 1151, but gated on the M0 integrity gate so a receipt cannot vouch for an index whose inverted index was never verified.

Change

Add a new digest-bearing search receipt surface implemented additively: a search_receipt result (library and CLI) beside the unchanged search_records, returning the matched record IDs together with the projection's source_record_set_digest and the integrity-gate outcome. Do not change the shape of search_records or existing receipts.

Acceptance

• Synthetic end-to-end fixture pinning a search receipt to its source record set digest, with a human-readable receipt through the CLI.
• The pinned digest-bound scan-projection fixture, the vertical slice, and both WITS conformance tests stay green. The second opinion measured empirically that naive Q1 output changes break all four; an additive implementation passed 593 tests and fixture replay.

Security and compatibility

• Security: query results become pinnable to the exact canonical record set that produced the index, closing the unpinnable-evidence gap once M0 guarantees the index itself was integrity-checked.
• Compatibility: additive only; no existing schema, CLI output, or fixture bytes change.

Sequencing: step Q1 of the corrected epic (M0, Q1, Q2+docs, Q3, Q4).

[joefeser]

Completed by the merged query-surface implementation and reconciled by PR #120 at merge commit 4c0723f. Digest-bearing additive search receipts are implemented and remain gated by projection integrity; default legacy output shapes remain compatible.