refactor(evidence): carry producer-owned source records

Carry the final artifact inspection's exact nested source Evidence through
AnalysisExecution. Derive links in the shared Evidence builder instead of
reparsing the result in CLI and MCP adapters. Retain validation for unknown
and historical Evidence inputs.

Move the shared source recorder into application ownership and migrate its
consumers. Record sources before parents; keep source recording failures
from publishing summaries. Decline snapshot entries whose source closure the
current entry format cannot represent, while retaining investigation Evidence.

Validation: actual ASAR regression failed before the change with missing
links and passes afterward; exact nested identity, source recorder refusal,
final-close cancellation and cleanup failure, historical authentication,
snapshot controls and public CLI/MCP workflows. Fresh runtime/catalog build,
full static/docs, discovery and duplication checks pass. Installed native
providers and platform-specific skipped cases remain unverified.

src/application/binary/AnalysisSnapshotCache.ts

@@ -436,6 +436,9 @@ export class AnalysisSnapshotCache {
     // The snapshot format does not carry reference truncation; a replay would
     // present a capped read as complete, so it is not recorded.
     if (execution.referencesTruncated === true) return;
+    // Provider snapshot entries do not carry execution source records. Replay
+    // must not discard the source closure that supplies the parent's Evidence links.
+    if ((execution.sourceEvidence?.length ?? 0) > 0) return;
     const queryId = analysisQueryId(
       snapshotTarget(target),
       snapshotBinding(profile),