nx_deploy_provenance.nx

nx_deploy_provenance.nx -- the team addresses the ROOT CAUSE of the deploy uncertainty (operator: "build the team to address the risk and uncertainty"). The live sites.elf's source is LOST because no deploy ever recorded WHERE it was built from. Fix: every deploy STAMPS provenance -- source location + source content-hash + build id -- so the source is always re-findable and a rebuild is always verifiable. An artifact with no provenance is UNTRACEABLE (exactly what bit us); the team refuses to TRUST an untraceable binary for a risky re-deploy, and re-stamps on the next clean build to restore traceability going forward. license_tier: ORIGINAL Pairs with nx_deploy_verify + the Genealogist.