Audit the provenance of a published URL

Returns a five-stage provenance audit for one published URL: ingestion (how the Knowledge Base sources behind the content entered the system), source (the exact retrieved chunks and formatted model context, hash-validated), creation (the accepted AI generation attempt, hash-validated), editing (the Builder workspace version history), and publication (every destination record for the published content version, with the publishing actor when one can be attributed). Each stage reports what can be proven from stored evidence and what evidence is missing, and the audit never guesses: absent or ambiguous evidence is reported as such rather than filled in. The URL must match a live publish record's recorded URL exactly (byte-for-byte after trimming surrounding whitespace); when several live records share the URL, the one with the most recent publish/attempt time is audited. Requires the GEO product.