R2 — deterministic Vercel deployment provenance binding

[eimyroot]

Scope

Bounded remediation of the production deployment provenance capability gap. No production deployment is performed by this PR.

Changes

• Reads canonical target identity from config/production-target.json.
• Production Vercel execution fails closed unless the target record is CANONICAL for production-hosting-target-identity, provider is vercel, team/project IDs match the canonical record, source SHA is known, checkout HEAD matches the expected SHA, checkout is clean, and productionApproved === true.
• Production Vercel CLI invocation uses explicit --project <projectId> and -T <teamId> binding, with redundant VERCEL_PROJECT_ID / VERCEL_ORG_ID environment binding.
• Deployment receipt schema v5 includes repository, branch, sourceSha, provider, teamId, projectId, mode, deploymentUrl, status, and verificationStatus.
• Adds deterministic tests for canonical match, project/team mismatch, missing SHA, missing production approval, explicit CLI binding, missing deployment URL, and command failure.

Explicit non-goals

• No production deployment.
• No branch governance changes.
• No secret/token write.
• No new project/service/agent/orchestration layer.
• No deployment workflow added yet: generated runtime output is ignored and there is no canonical CI-produced deployable artifact contract, so adding a production workflow here would not be a truthful executable path.

Validation

Focused local Node test: 8/8 provenance contract tests PASS. Full repository CI is required before merge.