Check first skill install against catalog-declared provenance

[samuv]

Summary

Closes #6310. Trust-on-first-use had no expected identity to check a
skill's very first install against — the verifier only recorded whatever
signer identity it observed, never validated it against anything. Every
install after that was enforced against the recorded lock entry, but the
first one was taken on faith.

toolhive-core v0.0.42 added Provenance to registry.Skill
(stacklok/toolhive-core#247, #248, #251) so a catalog entry can declare who
is expected to sign a given skill. This wires that into install-time
verification:

• When a skill resolves through the registry/catalog (a plain name like
  thv skill install code-review, not a direct OCI or git reference) and
  the resolved entry declares a provenance, it becomes the expected
  identity for verification — but only on a true first install. A lock
  entry, once one exists, always takes precedence over the catalog; the
  catalog only fills the gap before any trust decision has been recorded.
• An absent or empty catalog provenance is unconstrained, matching every
  other provenance field's "absent means unconstrained" contract — most
  catalog entries won't declare one for a while, and that must not block
  installs.
• A catalog-declared attestation constraint is refused outright rather
  than silently skipped: pkg/skills/verifier has no attestation-comparison
  logic today (unlike toolhive-core's own generic Sigstore.VerifyServer
  path used for MCP servers), so honoring the identity fields while quietly
  ignoring attestation would let a catalog author believe a guarantee is
  enforced when it isn't.

Also bumps toolhive-core to v0.0.42 as a separate commit (required for the
Skill.Provenance field) — that release also migrated toolhive-core's cel
package to the renamed cel.dev/cel-go module, which broke the two CEL call
sites in this repo (pkg/auth/awssts, pkg/authserver/server/tokenexchange)
that pass it EnvOptions from the old github.com/google/cel-go path. Fixed
as a mechanical import-path swap (confirmed Variable/MapType/StringType/
DynType all exist identically in the new module) in the same commit as the
bump, since the two are inseparable — any bump to v0.0.42 breaks the build
without it.

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

New tests: provenanceInfoFromCatalog's conversion (nil, fully-populated,
and attestation-refused cases), plus two install-flow tests —
TestInstallVerification_CatalogProvenanceUsedOnFirstUse (a registry entry
with no prior lock entry gets its declared identity enforced instead of
blind TOFU) and TestInstallVerification_LockEntryTakesPrecedenceOverCatalog
(once a lock entry exists, it wins over a catalog that has since changed
its declared identity).

task test passes for pkg/skills/..., pkg/auth/..., and
pkg/authserver/.... Ran the full suite once too: three failures appeared
(pkg/transport/proxy/streamable — a documented pre-existing port-8096
conflict from a stray unrelated process in this environment;
pkg/vmcp/server's TestForwarding_Logging_RealBackend and
TestIntegration_SSEGetConnectionSurvivesWriteTimeout — both timing-based
integration tests, confirmed passing when rerun in isolation, i.e. flakes
under full-suite resource contention, not a regression from this change).
go build ./... and go vet ./... are clean across the whole module.

Changes

File	Change
go.mod, go.sum	Bump toolhive-core to v0.0.42
pkg/auth/awssts/role_mapper.go, pkg/authserver/server/tokenexchange/multi_issuer_validator.go	Migrate CEL EnvOption import to cel.dev/cel-go/cel (mechanical, required by the bump)
pkg/skills/options.go	Add InstallOptions.CatalogProvenance (internal-only)
pkg/skills/skillsvc/registry.go	Carry the catalog entry's Provenance through registryResolveResult
pkg/skills/skillsvc/install.go	Convert and attach it in installFromResolvedRegistry
pkg/skills/skillsvc/verify.go	provenanceInfoFromCatalog conversion (fail-closed on attestation); fall back to it in verifyOCIInstall/verifyGitInstall only on true first use
docs/arch/12-skills-system.md	Document the catalog-provenance fallback
docs/server/*	Regenerated via task docs — toolhive-core's Skill type (exposed through the registry API) gained the provenance field along with the version bump

Does this introduce a user-facing change?

Yes, two ways:

• A skill installed by name (not a direct OCI/git reference) whose catalog
  entry declares an expected provenance is now checked against it on
  first install. Previously any correctly-signed artifact was accepted and
  its observed identity recorded unconditionally. No change for entries
  with no declared provenance (the common case today), and no change to
  any already-locked skill.
• The registry API's Skill schema (GET /registry/{name}/v0.1/x/dev.toolhive/skills
  and friends) gains an optional provenance field, inherited directly
  from the toolhive-core bump — additive and backward compatible.

Special notes for reviewers

Three commits: the dependency bump + CEL fix, the feature, then a
task docs regeneration I initially missed (CI's Swagger check caught it —
bumping toolhive-core alone was enough to change the registry API's
generated schema, since Skill gained the field independent of anything
this PR's own code touches). The CEL fix is unrelated to this issue but
unavoidable — any PR bumping to toolhive-core v0.0.42 breaks the build
without it, so it travels with the bump rather than as a separate PR.

[codecov]

Codecov Report

❌ Patch coverage is 88.09524% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.77%. Comparing base (dd0ea20) to head (d4edb31).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/skills/verifier/oci.go	52.94%	8 Missing ⚠️
pkg/skills/skillsvc/verify.go	93.75%	4 Missing ⚠️
pkg/skills/verifier/git.go	0.00%	2 Missing ⚠️
pkg/skills/verifier/offline.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6420      +/-   ##
==========================================
+ Coverage   77.71%   77.77%   +0.05%     
==========================================
  Files         759      759              
  Lines       72889    72979      +90     
==========================================
+ Hits        56646    56756     +110     
+ Misses      16238    16218      -20     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.