fix(policy): ignore advisor provenance during contract inference

[johntmyers]

Summary

Prevent policy-advisor contract inference from treating otherwise identical endpoints as distinct solely because one endpoint carries advisor provenance. This fixes the late follow-up identified on #2935, where a subsequent mechanistic proposal could be stored with an application error instead of being auto-approved.

Related Issue

No issue required: localized regression follow-up to #2935 and review comment.

Changes

• Ignore provider_credentialed and advisor_proposed provenance while deduplicating effective endpoint contracts.
• Ignore the same provenance while selecting an existing sandbox-owned rule.
• Preserve the incoming advisor marker when mirroring a provider-owned contract into a new sandbox overlay.
• Add the focused regression reproducer supplied in the review comment.

Testing

• mise run pre-commit passes
• cargo test -p openshell-policy passes (236 tests)
• Unit tests added/updated
• E2E tests not required; the regression is isolated to policy-library canonicalization

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs not required for this localized behavior correction