Record release provenance: resolve r_commit and core_commit

Resolve the two placeholder SHAs in sync/nns_source.json by matching the
vendored bytes to upstream history:

- r_commit 905b8bbd: the OVVO-Financial/NNS commit that introduced the
  exact vendored tools/NNS_13.0.tar.gz blob (parent carried a different
  tarball). Version 13.0 / Date 2026-06-10, Packaged 2026-06-11 03:14 UTC.
- core_commit 7f93df9d: the OVVO-Financial/NNS-core commit that authored
  the exact vendored extern/NNS-core include/src/CMakeLists objects (its
  parent had different include/src). A later commit carries the identical
  core forward unchanged.

The release provenance gate now passes for a real tagged release.

test_unknown_provenance_fails_real_release previously ran the gate against
the committed manifest and relied on it carrying placeholder provenance.
Point it at a fixture manifest so it tests the unknown-provenance failure
behavior without depending on the real manifest being unfilled.

Author: claude

sync/nns_source.json

@@ -1,10 +1,10 @@
 {
   "r_repo": "OVVO-Financial/NNS",
-  "r_commit": "unknown",
+  "r_commit": "905b8bbd42b3236bf88aba7f18df7a9a378dbd7b",
   "r_version": "13.0",
   "r_src_tree_hash": "654e411bd4e8caabfd57a1a4190eb1d97411e059",
   "core_repo": "OVVO-Financial/NNS-core",
-  "core_commit": "unknown",
+  "core_commit": "7f93df9dff8762df870c1fbba6e03c0469be6e69",
   "python_repo": "OVVO-Financial/NNS-python",
   "python_commit": null,
   "vendored_core_path": "extern/NNS-core",

tests/tools/test_release_provenance.py

@@ -43,8 +43,10 @@ def test_allow_unknown_passes_with_placeholder_provenance() -> None:
     assert result.returncode == 0, result.stdout + result.stderr
 
 
-def test_unknown_provenance_fails_real_release() -> None:
-    result = _run([])
+def test_unknown_provenance_fails_real_release(tmp_path: Path) -> None:
+    manifest = tmp_path / "manifest.json"
+    _write_manifest(manifest)  # default r_commit/core_commit are "unknown"
+    result = _run(["--manifest", str(manifest)])
     assert result.returncode != 0
     assert "provenance" in (result.stdout + result.stderr).lower()