feat: add provenance-complete execution evidence

[szmyty]

Summary

• add versioned run, artifact, and step evidence populated from actual executor outcomes
• persist atomic renderflow-run.json manifests and distinguish complete, partial, failed, and cancelled runs
• report cache hits, skipped transforms, validation/fidelity state, and structured diagnostics
• add the exact Flow flow.artifact/v1 projection, schema, fixtures, documentation, and credential redaction
• render CLI summaries from the structured execution result

Validation

• cargo check --workspace --all-targets --locked
• cargo test -p renderflow --all-targets --locked — 1,032 passed; 5 ignored
• targeted execution-evidence, cache, partial-failure, and cancellation tests
• end-to-end first-run and cache-reuse smoke test
• generated manifest validated against schemas/renderflow-run-v1.schema.json
• Flow fixture validated against Flow's current flow.artifact/v1 contract
• mkdocs build --strict
• changed Rust files pass rustfmt --check
• Clippy passes when allowing only the three existing baseline lints

Existing baseline issues

• strict workspace Clippy still reports three pre-existing lints:
  • crates/renderflow-core/src/detect.rs:107 — unnecessary_sort_by
  • crates/renderflow-core/src/planning.rs:1280 — unnecessary_sort_by
  • crates/renderflow-core/benches/cache.rs:119 — redundant_closure
• the workspace CLI integration suite still has 17 pre-existing fixture failures unrelated to this change
• no GitHub Actions results were relied upon

Closes #355