[abrichr]

Refs #1856, #1858.

Adds change-history rechecks across touched records and declared collateral
scope. A confirmed write remains provisional while the ledger owes a recheck.
The reader checks retained versions and deletions, refuses incomplete history,
and requires server-controlled provenance to attribute another user's edit.

This draft publishes checkpoint 8b4df94c for review. Its software validation
passed 372 focused tests with no skips, including 27 history controls and 16 MCP
tests, plus lint, format, type, generality, release and source-boundary guards.

Known limitations and unfinished work:

• Initial UNCERTAIN results incorrectly serialize final: true while still
  reporting verified: false. A separate correction is in progress.
• The correction candidate ran 379 tests: 377 passed and two existing receipt/
  ledger tests failed. Four parent/candidate diagnostic cases passed under
  tracing, whose overhead limits that result; the original causes remain
  unknown. The candidate is not part of this draft checkpoint.
• Real Medplum and OpenEMR acceptance has not run. The isolated native-history
  qualification, setup-derived quiet window, all five delay measurements and
  legitimate-other-user controls remain required. This PR does not close
  either issue.

A final verdict covers only its recorded history frontier. Later writes are
outside that time window; no finite quiet window proves absence of future
writes.