feat(provenance): Phase 2.1 PROVENANCE pallet scaffold v0.0.14 trait-first foundation

Phase 2.1 governance-first pattern (DC PROVENANCE_PALLET_V1 5/10 firmas, ratify
target 2026-05-29). Scaffold skeleton compile-clean canonical mientras Ergon
ships arkhe-noesis-attestation-types sub-crate Cap 42+ (target 2026-05-30→06-05).

Deliverables canonical:
- origin-chain-types/src/attestation.rs (NEW 250 LOC + 9 tests) — vendor copy
  temporal ValidationAttestation (interim Option B per Ergon decision Cap 41+)
  + OitIdentity + ValidationVerdict + SeverityTier + helper methods canonical
  (is_anchorable PROV-6, is_institutional PROV-5, signing_payload PROV-4 stub)
- origin-chain-provenance/src/lib.rs (NEW 260 LOC + 2 scaffold tests) —
  #[frame_support::pallet] structural skeleton: storage + dispatchable + events
  + errors + 5 RejectionReason variants (incluyendo MalformedValidationAttestation
  per Marihan refinement Phase 2.2 anticipated)
- 3 existing types canonical (AssetHash, AccountId, Signature, AssetAttestation):
  added Encode + Decode + DecodeWithMemTracking + MaxEncodedLen + TypeInfo derives
- workspace parity-scale-codec: max-encoded-len feature canonical added

Sub-decisions canonical implementadas (scaffold-level):
- PROV-2 Storage: StorageMap<AssetHash, AssetAttestation> Blake2_128Concat
- PROV-3 Dispatchable: attest_asset(origin, ValidationAttestation) flow básico
- PROV-5 OIT Level >= 3 enforce: via ValidationAttestation.validator_oit.is_institutional()
- PROV-6 is_anchorable check: verdict Passed/Warning + severity NOT Block/Critical
- PROV-7 Events: AssetAttested + AttestationRejected

Lo que NO funciona aún (deferred future slices):
- PROV-4 Ed25519 verification real (placeholder, requires Ergon sub-crate)
- Pallet wire en runtime canonical (v0.0.15 post DC ratify)
- Runtime API verify_provenance PROV-8 (v0.0.17)
- BoundedVec<AccountId, ConstU32<10>> agent_chain (v0.0.15)
- #[pallet::without_storage_info] scaffold-level (remove post BoundedVec)

Verification end-to-end:
- cargo check workspace verde 1.77s sin regression
- pallet-origin-provenance: 2/2 scaffold tests pass
- origin-chain-types: 45 tests pass (36 existing + 9 nuevos attestation)
- Slice 3 mock-WASM chain_spec builder operativo (NO regression)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -2201,7 +2201,11 @@ version = "0.0.1"
 dependencies = [
  "blake3",
  "ed25519-dalek",
+ "frame-support",
+ "frame-system",
  "origin-chain-types",
+ "parity-scale-codec",
+ "scale-info",
 ]
 
 [[package]]
@@ -2244,6 +2248,8 @@ dependencies = [
 name = "origin-chain-types"
 version = "0.0.1"
 dependencies = [
+ "parity-scale-codec",
+ "scale-info",
  "serde",
  "serde-big-array",
  "serde_json",