v0.8.9

Fixes

• identify: stop flagging legitimate multi-actor C2PA manifests as integrity clashes. The C2PA issuer attribution and the SynthID proxy are derived from the same manifest, so treating them as independent signals made the clash rule fire on valid manifests where a product wraps another vendor's engine (Microsoft Designer on OpenAI, Microsoft on Google) or an edit chain re-signs (Adobe over a Gemini original). Vendors named within one manifest are now grouped into a single provenance source; a clash still fires when a manifest vendor disagrees with a genuinely independent stamp (EXIF/XMP generator, IPTC AISystemUsed, AIGC, xAI).