Implement Context Builder provenance, redaction and audit handoff

[andrewperis]

Parent epic: #5

Summary

Implement Context Builder provenance, redaction and audit handoff for Context Builder v1.

Ownership and dependencies

• Repositories: platform; codex for shared audit contracts if required.
• Depends on: Implement budgeted Context Package v1 assembly #80, Implement context artifact lifecycle, safe caching and reproducible replay #81.
• Baseline: released Prompt SDK v1.0.0 and Context Package v1.0.0; do not change immutable contract bytes.

Scope and deliverables

• Record build/correlation IDs, builder/policy versions, approved input identities, selection/omission/budget outcomes, timing and package result identities.
• Separate restricted operational evidence from public-safe projections. Public records use approved opaque attestations rather than private paths, commits, object locations or hashes.
• Define pluggable local/test audit sinks with bounded delivery and explicit failure semantics; required policy audit failures must not silently authorize delivery.
• Link preparation evidence to eventual exact-instance use authorization without allowing the builder to impersonate an approving authority.

Acceptance criteria

• Success, denial, no-match, budget failure, expiry and sink failure are traceable without body leakage.
• Public projection tests prohibit non-public identifiers, fingerprints, credentials and diagnostic excerpts.
• Identity/correlation fields link to package and later Prompt SDK execution without changing released provenance semantics.
• A synthetic attestation/verifier demonstrates the public/private boundary without requiring a production signing service.

Implementation guardrails

Follow Constitution v1.0.0 at a9cc8a503aa30e17820edc62ac95f7cbe10e0564 and repository boundaries. Add focused tests with implementation; the suite task consolidates rather than postpones testing. Public issues, fixtures and docs use synthetic/already-public material only. Approved private inputs stay behind explicit secure artifact boundaries. No direct Lore checkout, silent declassification, self-approval or canon promotion.