feat(code): preserve ingest provenance and coverage

[ohdearquant]

Summary

• preserve normal, dev, and build dependency scope on manifest-derived depends_on edges, give import-scan edges an explicit production scope, and make code-audit cycle/layering checks ignore non-production back-edges while retaining a legacy fallback
• expose per-module import coverage and unresolved counts, stamp containment parents with canonical project ownership, and preserve safe coverage accounting when individual writes are refused by the secret gate
• attach repo-relative source_path and ingest source_revision provenance to modules and symbols, with crate-aware lib.rs/main.rs module identities and deterministic re-ingest behavior

Validation

• cargo test -p khive-pack-code --test source_ingest (9 passed)
• cargo test -p kkernel code_audit (16 passed)
• cargo test --workspace
• cargo check --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all -- --check
• RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps

Closes #1600
Closes #1603
Closes #1605

AI-assisted contribution: Codex prepared this change and PR description.