M10: provenance populate + re-capture from source (bank-only)

Pure provenance core (recipe fingerprint, FX-chain identity, parent
detection) + shell reads; capture stamps provenance on resample-from-sample;
re-capture regenerates a provenanced sample from its source, never touching
the timeline. Adds BankIndex/BankBook in-place update. CTest-covered.

src/bank_model.h

@@ -131,6 +131,19 @@ public:
     // Removes the sample with `id`. Returns true if one was removed.
     bool remove(const std::string& id);
 
+    // Replaces the sample carrying `id` IN PLACE (preserving its position in
+    // insertion order), with `updated`. Used by M10 re-capture-from-source: a
+    // provenanced sample's file is regenerated and its metadata (relativePath,
+    // contentHash, levels, timestamp, ...) refreshed while its identity (id) and
+    // slot are kept, so the bank panel shows the same tile updated rather than a
+    // reordered new entry. `updated.id` should equal `id` (the caller keeps the id
+    // stable); a differing id is written through as given (the caller's contract).
+    // Does NOT dedup — an in-place refresh of one entry is not a new insert, so the
+    // collapse-by-hash rule (which guards NEW inserts) does not apply. Returns false
+    // (no mutation) if `id` is absent or `updated.relativePath` is absolute
+    // (the relative-paths-only invariant still holds for the replacement).
+    bool updateInPlace(const std::string& id, const Sample& updated);
+
     // Returns the sample with `id`, or nullptr if absent. The pointer is
     // invalidated by any mutating call.
     const Sample* query(const std::string& id) const;