feat(supplier): Phase 2 — federation handshake (rivet supplier pull) + FederationProvenance

[avrabe]

Context

Phase 1 MVP shipped in #286: `external-anchor` artifact type, 3-state coverage, `rivet supplier list` + `rivet supplier check` commands. The MVP describes the boundary; nothing crosses it yet.

Phase 2 scope

Per `docs/design/cross-org-supplier-traceability.md` §6 Phase 2:

1. `derives-from-external` link type with structured (mapping) target.
2. `cited-source` backends for `kind: reqif` (read-only, sha verification at fetch).
3. `rivet supplier pull ` for `kind: file | reqif`, storing under `.rivet/supplier-cache//`.
4. `FederationProvenance` block on imported artifacts (source_org, source_tool, source_id, anchor, fetched_at, source_hash, mapping_recipe).

Out of scope (Phase 3)

• Field-mapping recipes (`schemas/supplier-mappings/`).
• `rivet supplier publish` for rivet-to-rivet manifest emission.
• OSLC / Polarion / GitHub-issues backends.
• Variant-aware anchors.
• `rivet supplier promote`.

Refs: design doc §6 Phase 2, original issue #253.

[avrabe]

Phase 2 implementation up for review in #292.

All four scope items are implemented (none deferred):

1. derives-from-external link type with structured mapping target — Link.external: Option<ExternalLinkTarget> carries {org, contract, doc-id, last-synced, sha256, anchor}; flat-string targets round-trip unchanged. Schema entry in schemas/common.yaml.
2. cited-source ReqIF backend — local-file read, sha256 verification, XML well-formedness gate via the existing reqif::parse_reqif.
3. rivet supplier pull <anchor> for kind: file | reqif — caches under .rivet/supplier-cache/<org>/<contract>/, refuses to write on stamped-hash drift, idempotent on re-run.
4. FederationProvenance block on Provenance — {source-org, source-tool, source-id, anchor, fetched-at, source-hash, mapping-recipe}, stamped into the cache manifest at pull time.

Each item ships oracle-gated tests that fail without the change; full fmt/clippy -D warnings/test --workspace gate is clean.

Phase 3 scope (field-mapping recipes, supplier publish, OSLC/Polarion backends, variant-aware anchors, supplier promote) remains deferred per the design doc §6 — out of scope for this PR.

---

Generated by Claude Code