Snapshots carry no repository provenance: no repo URI, revision, or analyzer identity/config (CLDK-006)

[rahlk]

Target: canonical schema v2 (epic #69) — provenance fields are contract surface, and the requirement is cross-analyzer (the audit found the identical absence in the TypeScript analyzer's export), so the field set should be decided once at the canonical-schema level via designing-cldk-changes. From the external v0.3.0/Odoo quality audit, finding CLDK-006 (severity High).

Audit evidence

• Odoo export: 6,086 modules, all with content_hash + last_modified — zero with a source revision or repository URI.
• :PyApplication metadata is {name, schema_version} only.
• Same result for the sibling TypeScript export (386 modules, same absences).

A snapshot therefore cannot say what code it analyzed: no way to re-fetch the exact revision, diff two snapshots' provenance, or bind scanner findings to a commit.

Root cause

Never implemented. The analyzer's input model is "a directory": build_pymodule_from_file captures filesystem provenance only (content_hash, last_modified, file_size — symbol_table_builder.py:112-116), the application node is emitted with name + schema version only (codeanalyzer/neo4j/project.py:56-58), and nothing in the codebase touches git.

Fix direction (v2)

Extend the v2 payload envelope (which already carries schema_version, language, max_level, k_limit) with immutable provenance captured at analysis time, per the audit gate — a snapshot independently identifies and can re-fetch:

• repository URI + source revision (when the analyzed root is a git checkout; explicit unversioned marker otherwise, plus a dirty-tree flag),
• analyzer identity: name, version, configuration (level, flags),
• and keep the existing per-module content hashes, which then bind modules to the revision.

Mirror the same fields in the :PyApplication node so both projections agree (two-projection agreement is already a v2 invariant).