test(honesty): a reading may resolve stronger than declared, never weaker

Closes the guardrail gap `b2dd07b` came out of. Nothing compared a reading's
provenance against its entity's declared provenance, so a schema promising a
live observation for a value never observed was invisible.

The assertion is one-directional on purpose. Equality would be wrong: `Entity`
carries one provenance and cannot say "varies per row", so a cluster whose rows
legitimately differ declares the weakest and over-delivers on the rest. Only the
`Measured` direction is checked, because ranking `Derived` against
`Specification` is not meaningful -- derived from measured inputs is live,
derived from a vendor table is not -- and a total order would invent a
comparison the type does not support.

It failed on its first run with 39 violations in two classes, which is the
deliberate break this project asks for before keeping a test:

- `gpu.codec.{n}.max_bit_depth` declared Measured while resolving per row. Five
  sibling entities were corrected in b2dd07b and this sixth was missed -- by
  reading the declarations, twice. That is the whole argument for the test.
- `cpu.core.{n}.utilization` declared Measured across all 24 cores while the
  resolver computes `100 - idle` and emits derived. Pre-existing.

Fixing the second tripped `derived_provenance_and_inputs_agree`: a derived
entity must name its inputs, and the per-core idle it derives from was not an
entity. It was read and then discarded, so the derivation pointed at something
no consumer could fetch. `cpu.core.{n}.idle` is now published beside it,
mirroring the `cpu.total.idle` that already existed -- a reader holding data the
schema does not expose is invisible to every agent.

Still open, deliberately: `cpu.total.utilization` declares Measured *and*
`.derived(&["cpu.total.idle"])`, a contradiction, and resolves Measured while
its per-core twin resolves Derived for the same computation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>