Add legacy closeout provenance recovery

[yvette-carlisle]

Summary

• add durable worktree provenance for runtime-recorded, runtime-recovered, scan, and legacy-unknown rows
• surface legacy cleanup-only audit requirements in operator status/dashboard and docs
• add decodex recover legacy-closeout as an explicit manual-authority fallback

Validation

• cargo test -p decodex legacy --all-features -- --test-threads=1
• cargo test -p decodex runtime_recovery --all-features -- --test-threads=1
• cargo test -p decodex worktree --all-features -- --test-threads=1
• cargo test -p decodex recovery --all-features -- --test-threads=1
• cargo make fmt
• cargo make lint-fix
• cargo make test
• cargo make check
• git diff --check