feat: expose dataset version provenance reads - #3462

Summary

Adds authenticated, tenant-scoped, bounded DatasetVersion list/detail reads with stable IDs, content hashes, legacy row links, and source trace/span provenance. Query parameters use the shared validated serializer and are capped at limit 500. Legacy dataset writes remain unchanged.

Linear: TH-8551; parent #3461

AI use: Codex assisted with repository inspection, serializer/view drafting, and focused test updates; Codex reviewed query and tenancy boundaries; human approval is not claimed.
E2E: exempt (harness-gap version-read routes are not yet covered by a browser flow)

Validation

ruff check and ruff format --check on touched Python files passed. makemigrations --check --dry-run with test settings reported no changes; PostgreSQL history check was unavailable at 127.0.0.1:15432. Seven database-backed tests could not set up because PostgreSQL is unavailable; the pure request-validation tests are separate evidence. OpenAPI generation with an isolated EE overlay added 2 version operations and 6 schemas; unrelated invoice-preview drift was excluded. OpenAPI generation used EE main ab169e6 without allowing surface shrink. Validation: 14 request-validation/missing-tenant tests passed; 48 API-contract/MCP tests passed; yarn contracts:check passed (1060 paths, 1433 operations, zero debt, endpoint registry 799/799). Ruff lint/format, staged safety and diff checks passed. Temporary overlays were removed. This remains a draft compatibility slice, not a released contract; no split or analysis API is included.

Stack: parent #3461; next #3460. This read-only change requires the parent schema; reverting the routes preserves all stored records. Normal pre-commit hook could not resolve [email protected]; explicit checks were run before committing with the hook disabled. No feature flag, backfill, browser receipt or deployment is included.

Database verification update

Final stack a71e2ba was exercised against a disposable PostgreSQL 16 database. The real migration graph applied 645 migrations, including 0123/0124/0125, and the combined model/API/run suite returned 43 passed in 65.00s (7 dataset-model, 21 dataset-API, 15 run-contract cases; 10 total DB-backed cases). ClickHouse migration was explicitly skipped with FI_SKIP_CH25_MIGRATION=1; ClickHouse/worker/browser qualification remains separate. Receipt: /tmp/dataset-db-audit-skipch-20261012.xml. The isolated database was removed after verification. This supersedes earlier PostgreSQL-unavailable results.