ductus-provenance-invariants

Check Ductus evidence canonicalization, hashes, signatures, segment/request identity, ordering, receipts and replay against actual source at a full revision. Use for evidence chains, retries, changed payloads, tamper/gaps and reconstruction claims; do not infer authorship.