feat: content-addressed provenance with sig: prefix

[laulauland]

Summary

Replace VCS-based provenance (@git-sha) with content-addressed signatures (@sig:<xxhash3-hex>). Staleness is detected by comparing fingerprints directly — no VCS calls needed.

This fixes:

• Replace provenance git sha with content sha instead, as it doesn't work nicely when altering commits #10: amending/rebasing no longer invalidates provenance (content doesn't change)
• When a change is uncommitted it keeps reporting as stale #9: uncommitted files can be linked (no commit needed, hashes disk content)
• Circular relink problem: squashing/rebasing doesn't affect content hashes

How it works

drift link computes an XxHash3 fingerprint of the file (or symbol's AST subtree) and stamps it as @sig:<16-hex-chars>. drift check recomputes the fingerprint and compares — match means ok, differ means STALE.

For supported tree-sitter languages (TypeScript, Python, Rust, Go, Zig, Java), the fingerprint is AST-normalized so formatting-only changes don't trigger staleness. Unsupported languages fall back to raw content hash.

Blame is decoupled from provenance — derived from the spec file's last-modified commit instead of the provenance value.

Migration

Legacy @<git-sha> provenance continues to work. drift link always stamps sig: going forward. Specs migrate organically as they get relinked.

Changes

• main.zig — checkAnchorBySig, computeFingerprint, computeContentSig for sig-based check/link
• main.zig — runLink computes content sigs instead of git rev-parse
• frontmatter.zig — test verifying anchorFileIdentity handles sig: prefix
• docs/ — updated DESIGN.md, CLI.md, DECISIONS.md, SKILL.md

Test plan

• drift link spec.md file.ts stamps @sig: provenance
• drift link spec.md (blanket) computes per-anchor sigs
• drift check with @sig: anchors: ok when content matches, STALE when different
• Legacy @<git-sha> anchors continue to work
• Formatting-only changes don't trigger staleness for supported languages
• Blame info shown when STALE (derived from spec's last commit)