Schema migrations must preserve unknown provenance instead of guessing from current bindings

When an old immutable receipt lacks a provenance field added by a newer schema, do not backfill it by selecting an arbitrary currently matching binding. Several current bindings may satisfy the remaining columns, and bindings may have changed since the historical event. Such a migration may preserve conservation while fabricating audit history and rejecting the real replay. Prefer an authoritative event or journey record; if none exists, store an explicit unknown/ambiguous state or quarantine the receipt for manual resolution. Add an adversarial migration test with multiple equally matching bindings.