feat(provenance): fork-first-class chain model — ADR-0010 (#31; supersedes #32) (#122)

Implements ADR-0010 (now Accepted). The provenance integrity property
is tamper-evidence + no-silent-loss, NOT linearity: legitimate
divergence (partitioned/replicated/offline writers, simulation
branches) must be representable, persisted, detectable and verifiable.

Schema
- NO `UNIQUE(entity_id, previous_hash)` (#32, superseded): it would
  reject a divergent writer's honest history at insert time. The `hash`
  PRIMARY KEY is the correct duplicate guard (domain-tagged preimage).
- Add non-unique `idx_provenance_predecessor` → O(log n) fork detection.
- `verisimdb_provenance_chain_heads(entity_id, head_hash)` multi-head
  tip set; legacy single-head table kept one release with an idempotent
  `INSERT … SELECT` migration (no destructive DROP ships here).

Behaviour
- `append_provenance`: linear fast-path — extends the unique head;
  errors (not silently collapses) if the entity has >1 head.
- `append_provenance_fork(from_hash)`: extends a specific ancestor,
  *adds* a head without removing one → the entity now has ≥2 tips.
- `fork_points()`: every predecessor with >1 child.
- `verify_chain`: per-branch walk (each tip → genesis) so a forked-
  but-honest entity verifies true while tampering any branch still fails.

codegen `overlay.rs` mirrors the schema (harmful `ux_provenance_chain`
removed); its DDL tests inverted to assert the ADR-0010 contract.

Tests: `tests/provenance_fork_test.rs` rewritten to the 4 ADR-0010
cases (the previously failing-by-design test now passes) +
`exact_duplicate_entry_is_rejected`. Full suite green (107 lib + 9 + 4
+ 2, 0 failed). ADR-0010 Proposed → Accepted.

Closes #31. Supersedes #32 (closed not-planned).

Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath