Observe exact source workspace lifecycle

Canonical negative lifecycle/provenance protocol, not a content/edit grant or general user-info API. Same actual write caller and concrete source/request/epoch/placement incarnation are checked. proof=caller accepts only source_id/request_id/source_epoch/proof and returns one purpose-bound callback identity/ceiling; it terminates the callback without acquiring leases. Normal proof is a lifecycle observation with opaque source lease keys, never reusable positive permission. purpose defaults to artifact_workspace_write; workspace_reference_write uses explicit real placement and a stable opaque reference key without a fabricated source identity, protecting incarnation/recreation races. ASP is accepted only for its existing concrete publisher source path. App/general system credentials are refused.