Attest third-party File Provider uploads natively

[seonghobae]

Summary

• attest OneDrive and Google Drive copies from bounded macOS File Provider metadata before requiring OAuth
• require an already-local current version, bind provider upload flags to receipt size and BLAKE3, and recheck file identity to avoid hydration and TOCTOU drift
• retain the authenticated provider API checksum path as an optional fallback when native evidence is unavailable or incomplete
• expose native attestation in the GUI and headless planner while preserving the source and providing no deletion action

Metadata-first safety

• filenames and filename dates remain secondary review evidence only
• provider-owned upload/current-version metadata is parsed fail-closed
• cloud-only placeholders are rejected before hashing, so verification does not hydrate them
• the destination must remain inside the discovered root for the receipt provider

Local evidence

• macOS File Provider returned the expected upload, locality, pause, exclusion, and in-flight fields for the configured OneDrive root
• a cloud-only OneDrive item reported uploaded but not downloaded; the native gate correctly treats that state as non-hashable without hydration

Validation

• npm run check
• npm test -- --run: 18 passed
• cargo test --manifest-path src-tauri/Cargo.toml --locked --no-default-features provider_: 34 passed, 1 ignored live-environment test
• CLI forged-receipt-before-probe test passed
• git diff --check

Stacked on #31.