chore(quality): gate provider asset provenance (#11743)

Merged via /merge-batch (v3.8.51 provenance sweep). Boarded and validated together with the batch's other provenance PRs in a combined worktree — full gate suite green, including the new provider-asset-provenance gate/manifest introduced here. Thank you.

.github/workflows/ci.yml

@@ -93,6 +93,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@v7
         with:
@@ -127,6 +128,7 @@ jobs:
       - run: npm run check:any-budget:t11
       - run: npm run check:provider-consistency
       - run: npm run check:model-lifecycle
+      - run: npm run check:provider-asset-provenance
       - run: npm run check:fetch-targets
       - run: npm run check:deps
       - run: npm run check:file-size

.github/workflows/quality.yml

@@ -269,7 +269,7 @@ jobs:
         run: |
           set -uo pipefail
           gates=(
-            provider-consistency fetch-targets deps file-size error-helper
+            provider-consistency provider-asset-provenance fetch-targets deps file-size error-helper
             migration-numbering public-creds db-rules known-symbols
             route-guard-membership test-discovery test-runner-api
             mutation-test-coverage any-budget:t11 build-scope pack-policy