feat(provenance): Phase 2.1 PROVENANCE pallet scaffold v0.0.14 trait-first foundation

Phase 2.1 governance-first pattern (DC PROVENANCE_PALLET_V1 5/10 firmas, ratify
target 2026-05-29). Scaffold skeleton compile-clean canonical mientras Ergon
ships arkhe-noesis-attestation-types sub-crate Cap 42+ (target 2026-05-30→06-05).

Deliverables canonical:
- origin-chain-types/src/attestation.rs (NEW 250 LOC + 9 tests) — vendor copy
  temporal ValidationAttestation (interim Option B per Ergon decision Cap 41+)
  + OitIdentity + ValidationVerdict + SeverityTier + helper methods canonical
  (is_anchorable PROV-6, is_institutional PROV-5, signing_payload PROV-4 stub)
- origin-chain-provenance/src/lib.rs (NEW 260 LOC + 2 scaffold tests) —
  #[frame_support::pallet] structural skeleton: storage + dispatchable + events
  + errors + 5 RejectionReason variants (incluyendo MalformedValidationAttestation
  per Marihan refinement Phase 2.2 anticipated)
- 3 existing types canonical (AssetHash, AccountId, Signature, AssetAttestation):
  added Encode + Decode + DecodeWithMemTracking + MaxEncodedLen + TypeInfo derives
- workspace parity-scale-codec: max-encoded-len feature canonical added

Sub-decisions canonical implementadas (scaffold-level):
- PROV-2 Storage: StorageMap<AssetHash, AssetAttestation> Blake2_128Concat
- PROV-3 Dispatchable: attest_asset(origin, ValidationAttestation) flow básico
- PROV-5 OIT Level >= 3 enforce: via ValidationAttestation.validator_oit.is_institutional()
- PROV-6 is_anchorable check: verdict Passed/Warning + severity NOT Block/Critical
- PROV-7 Events: AssetAttested + AttestationRejected

Lo que NO funciona aún (deferred future slices):
- PROV-4 Ed25519 verification real (placeholder, requires Ergon sub-crate)
- Pallet wire en runtime canonical (v0.0.15 post DC ratify)
- Runtime API verify_provenance PROV-8 (v0.0.17)
- BoundedVec<AccountId, ConstU32<10>> agent_chain (v0.0.15)
- #[pallet::without_storage_info] scaffold-level (remove post BoundedVec)

Verification end-to-end:
- cargo check workspace verde 1.77s sin regression
- pallet-origin-provenance: 2/2 scaffold tests pass
- origin-chain-types: 45 tests pass (36 existing + 9 nuevos attestation)
- Slice 3 mock-WASM chain_spec builder operativo (NO regression)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/origin-chain-provenance/Cargo.toml

@@ -7,9 +7,38 @@ license.workspace = true
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
-description = "Asset attestation ledger: BLAKE3 + Ed25519 + Merkle anchoring per CHN-7. STUB v0.0.1 — implementation lands Phase 2 of Charon roadmap."
+description = "Asset attestation pallet canonical per CHN-7. Phase 2.1 scaffold v0.0.14 — trait-first foundation pattern. Real impl post Ergon arkhe-noesis-attestation-types Cap 42+ sub-crate."
 
 [dependencies]
-origin-chain-types.workspace = true
-blake3.workspace = true
-ed25519-dalek.workspace = true
+# Origin Chain canonical types (vendor ValidationAttestation interim Option B)
+origin-chain-types = { workspace = true }
+
+# FRAME canonical pallet macro + storage + dispatch + events + errors
+frame-support = { workspace = true }
+frame-system = { workspace = true }
+
+# Crypto canonical
+blake3 = { workspace = true }
+ed25519-dalek = { workspace = true }
+
+# SCALE codec canonical
+parity-scale-codec = { workspace = true }
+scale-info = { workspace = true }
+
+[features]
+default = ["std"]
+std = [
+    "origin-chain-types/std",
+    "frame-support/std",
+    "frame-system/std",
+    "parity-scale-codec/std",
+    "scale-info/std",
+]
+runtime-benchmarks = [
+    "frame-support/runtime-benchmarks",
+    "frame-system/runtime-benchmarks",
+]
+try-runtime = [
+    "frame-support/try-runtime",
+    "frame-system/try-runtime",
+]