feat(prover): delivery C: the ordered trace with argument provenance for every examined pair

Codex delivery under spec access-control-prover, requirement 9. `semantic/obligations/trace.py` serialises each
(entry, operation) pair the prover examined, discharged or unguarded: the entry with its boundary, access and
parameters; each hop in order with its call line, the guards before the call and the values forwarded; the
operation with the provenance of each argument traced through the function's binds; the guards after it; the
verdict. One canonical text form and one JSON form, no language, framework, repository, size or count fields.
The prover result, the arm record and each unguarded finding carry the traces. On the ec2-plugin fix: 32
traces, 4 unguarded. Gate: 3534 tests pass; the reserved-repository guard passes on the tracked export.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

benchmarks/valid/prover_arm.py

@@ -50,6 +50,7 @@ def _prove(change, repos, *, max_depth):
         "status": "prover_covered",
         "instrument": instrument,
         "findings": [],
+        "traces": [],
         "coverage": {},
         "degradations": [],
         "push": {"admission": {"defects": [], "dispositions": []}, "quick_tier": []},
@@ -112,7 +113,12 @@ def _prove(change, repos, *, max_depth):
                         raise InstrumentFailure("zero-byte read")
                 result = prove_change(root, change, ctx, max_depth=max_depth)
                 instrument["hook_bytes_read"] = sum(instrument["file_bytes"].values())
-                record.update(findings=list(result.findings), coverage=asdict(result.coverage), degradations=list(result.degradations))
+                record.update(
+                    findings=list(result.findings),
+                    traces=list(result.traces),
+                    coverage=asdict(result.coverage),
+                    degradations=list(result.degradations),
+                )
                 record["push"]["admission"]["defects"] = [
                     {**finding, "defect_id": finding["id"], "source": "prover", "locations": [[finding["path"], finding["line"]]]}
                     for finding in result.findings