spec: add orthogonal K0 source provenance

[TsekaLuk]

Outcome

Adds an exact companion source-map artifact from resolved ASR JSON Pointers to original UTF-8 byte ranges without putting provenance into semantic ASR or its hashes.

This is a stacked draft increment on #9. It does not merge, freeze, or authorize a production compiler.

Design boundary

• LCP-0003 and draft LDR-0007 specify the orthogonal ASR/source-map pair.
• Source inventory is manifest-closed, content-addressed, and ASCII ordered.
• Ranges use original half-open UTF-8 byte offsets, including non-ASCII comments.
• Source-derived objects have nonempty ranges; omitted unit results have explicit zero-width synthetic provenance.
• asr_hash binds the map to canonical semantic ASR under a separate domain.
• Source maps are excluded from ASR, contract-expression, and future Core hashes.

Executable evidence

• Node and Python parsers agree on 78/78 source cases.
• 7 accepted syntax maps pass exact-coverage and UTF-8-boundary audits.
• Node and Python resolvers agree on 39/39 package cases.
• 12/12 resolved ASRs and companion maps pass closed-schema, identity, hash, pointer, coverage, ownership, and containment audits.
• 7/7 structurally valid provenance tamper mutations are rejected.
• 71/71 K0 layer-boundary probes reject later-layer smuggling.
• Two consecutive npm test runs produced identical lock/report hashes.

Deliberate nonclaims

• Field identities are not elaborated.
• Type checking and resolved-ASR-to-Core lowering do not exist.
• Core hash reachability is therefore not yet demonstrated.
• LCP-0003 remains PROPOSED and LDR-0007 remains DRAFT.
• G0 remains FAIL.

Verification

npm test passes locally. The local host has no Lake executable, so the pinned Lean replay is delegated to the repository workflow.