feat: add provenance artifact reuse canary

[SecretSettler]

Summary

• add a default-off provenance-aware artifact/tool-context reuse canary
• keep the first full tool_result/assistant_context artifact body and replace later exact duplicates with a shorter resolvable ContextPilot reference
• wire the canary into the Hermes runtime hot path after prompt canary and before block dedup
• extend trace validation with an artifact gate and reference-resolution invariant
• document artifact canary rollout and validation commands

Safety

• default off via CONTEXTPILOT_ARTIFACT_DEDUP_MODE=off (default)
• kill switch: CONTEXTPILOT_ARTIFACT_DEDUP_DISABLE=1
• only role=tool / assistant_context artifact bodies are mutable; user/system/skill are protected
• exact-only, first canonical full body kept, strictly-shorter references only
• validation fails dangling references; reports/telemetry are metadata-only

Validation

• RED observed: tests/test_artifact_dedup_canary.py failed with ModuleNotFoundError before implementation
• python3 -m compileall -q init.py contextpilot/hermes_opportunities/artifact_dedup_canary.py contextpilot/trace_validation/runner.py
• python3 -m pytest tests/test_artifact_dedup_canary.py tests/test_trace_validation_runner.py tests/test_prompt_dedup_canary.py tests/test_hermes_plugin_patch.py -q
• python3 -m pytest -q
• python3 scripts/build_trace_validation_set.py --since-hours 96 --limit 50 --min-input-tokens 1000 --out /root/contextpilot/validation_sets --date 2026-06-15-artifact
• python3 scripts/run_trace_validation.py /root/contextpilot/validation_sets/validation_set_2026-06-15-artifact.jsonl --gate artifact --candidate-mode shadow --format markdown
• python3 scripts/run_trace_validation.py /root/contextpilot/validation_sets/validation_set_2026-06-15-artifact.jsonl --gate artifact --candidate-mode canary --format markdown