fix(osv): preserve immutable direct-source provenance

.github/workflows/osv-direct-source-quality-ci.yml

@@ -0,0 +1,63 @@
+name: OSV Direct Source Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - '.github/workflows/security-scan.yml'
+      - '.github/workflows/osv-direct-source-quality-ci.yml'
+      - 'scripts/ci/osv_direct_source_reconcile.py'
+      - 'tests/test_osv_direct_source_reconcile.py'
+      - 'docs/doctoring/osv-direct-source-provenance.md'
+permissions:
+  contents: read
+
+concurrency:
+  group: osv-direct-source-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  provenance-contract:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+      - name: Install exact hash-verified quality dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: '1'
+          PIP_NO_INPUT: '1'
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/osv-provenance-quality-requirements.txt" <<'EOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          EOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/osv-provenance-quality-requirements.txt"
+      - name: Verify full central suite and provenance coverage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run --branch -m pytest --import-mode=importlib tests -q
+          python -m coverage report \
+            --include='scripts/ci/osv_direct_source_reconcile.py' \
+            --show-missing \
+            --fail-under=100
+          python -m compileall -q \
+            scripts/ci/osv_direct_source_reconcile.py \
+            tests/test_osv_direct_source_reconcile.py
+          git diff --exit-code