feat: carry scan provenance through the dependency-model merge

[ericfitz]

Summary

dependency-model's merge step drops the provenance fields that layer 1 works to establish.
merge_envelopes (dependency-model/scripts/depgraphlib/merge.py) keeps only categories, so
scan.confidence (high | partial | low), seeded_by, and each envelope's target never
reach the synthesis contract.

The consequence is that report — the terminal artifact a human actually reads — can never tell
that the scan behind a category was low-confidence. A partial scan and a thorough one render
identically.

Schema and code currently agree, so this is not a defect against the published contract. It is a
design gap: for a plugin whose entire discipline is provenance and evidence, losing the confidence
signal at the join is the one place that discipline breaks.

Surfaced by the whole-branch review of #49 (finding I8), which explicitly recommended filing it
rather than widening that branch — it is a schema addition and therefore a scope call.

Acceptance Criteria

• synthesis.schema.json carries per-category provenance (at minimum confidence; consider
  seeded_by and target), with contract_version bumped per the versioning policy
• merge_envelopes propagates those fields rather than discarding them
• Conflicting values across envelopes for one category have a stated precedence rule, the way
  failed status already does
• report states a category's scan confidence when it is not high, and never presents a
  low-confidence result as settled
• The worked example in references/contracts/examples/ demonstrates a non-high case

Notes

• Related: feat: add skills for dependency analysis #46 (parent), feat: dependency synthesis — report, dependency graph, service health (layer 2 of #46) #49 (the layer-2 branch that surfaced this).
• Versioning: contract_version is deliberately pinned at 1.0.0 until the feature is declared
  productionized. This change is the kind that should move it — confirm before bumping.
• merge.py's existing failed-never-downgrades rule is the precedent for how a per-category
  field should behave when envelopes disagree.