Interface EvidenceProvenance

Who/when/what produced a given EvidenceModel instance -- matching env-cap's own EvidenceProvenance shape exactly, so a consumer reading both packages' evidence artifacts reads one vocabulary, not two.

generatedAt/toolVersion are required: every real caller can supply both (the tool version is data-cap's own installed version, read from its package.json -- see package-version.ts), and a provenance stamp that might be missing either one is a provenance stamp no consumer can rely on. commit stays caller-supplied and explicitly string | undefined (never omitted from the shape): data-cap never shells out to git itself, so an absent commit is a stated absence, never a guess -- ADR 0050's "provenance is caller-supplied, never ambient-detected" convention, kept exactly where it still applies.