M10: provenance populate + re-capture from source (bank-only)

Pure provenance core (recipe fingerprint, FX-chain identity, parent
detection) + shell reads; capture stamps provenance on resample-from-sample;
re-capture regenerates a provenanced sample from its source, never touching
the timeline. Adds BankIndex/BankBook in-place update. CTest-covered.

src/bank_book.cpp

@@ -304,6 +304,13 @@ RemoveResult BankBook::removeSample(const std::string& sampleId,
                                         : RemoveResult::RejectedSampleAbsent;
 }
 
+bool BankBook::updateSampleInPlace(const std::string& sampleId, const Sample& updated) {
+    for (auto& b : banks_)
+        if (b.index.query(sampleId) != nullptr)
+            return b.index.updateInPlace(sampleId, updated);
+    return false;  // no bank holds the id
+}
+
 bool BankBook::hashReferencedElsewhere(const std::string& hash,
                                        const std::string& exceptBankId) const {
     if (hash.empty()) return false;  // empty hashes never dedup (mirror findByHash)