Enforce lane-provenance.json append-only against the base branch in CI #175

Follow-up from #145 round 11 (local Codex P2 on lane-provenance.json, declined with evidence).

The registry contract (tools/sota-convergence/README.md, ~:976) says entries merged to main are never edited. Nothing in CI enforces that. The file is a verdict_review_gate.py TRUST_PATHS entry, so a PR that changes it together with a sealed verdict fails the gate, and scripts/landscape.py fails CI on a sealed return an edit would orphan. But a rules-only PR can still edit a merged entry, and no check compares the registry with the base branch's version.

Proposed: a CI test (in the gate or a validate step) that each registry list (claude, codex, adjudication) at HEAD starts with the base branch's list unchanged, so entries can only be appended, while entries added within the same unmerged PR stay amendable. Reviews of #145 checked this by hand every round (last check: main 4911baf's lists are unchanged prefixes at ca89c0d).

🤖 Generated with Claude Code