Generate changelog provenance from committed skill bytes

[devantler]

🤖 Generated by the Agentic Engineer

Problem

Release notes can claim an upstream revision from an uncommitted working file even though the changed skill inventory belongs to a committed head.

Proposal

Read surviving skill provenance from regular committed blobs, using the same revision as the change observation.

Acceptance criteria

Altered, missing and linked working copies cannot substitute provenance; removed skills retain their committed prior provenance and invalid committed metadata refuses the batch.

Reproduced offline against freshly fetched main using synthetic fixtures. No inspected source was executed and no provider experiment was launched. Size: S.

Part of #101.

[devantler]

🤖 Generated by the Agentic Engineer

Delivered in merged PR #486 at reviewed head d324854. The regression and actual user-path checks passed before merge; merged source was read back.