Worktree checkouts make old logs look recent: mtime lies in audits

When you audit which API backend a project used in a date window (for example, a billing question), a search like find -newermt plus grep gives false positives. Git worktrees and copied output folders give old logs a new mtime at copy or checkout time. Search the main repo apart from the worktrees, and drop hits whose file names carry an older date. To decide how calls reached a provider, prefer the run's own records, such as a logged route or auth mode in the run report or the CLI stream field apiKeySource, over flag strings in scripts. Scripts can still name a backend that no current run uses.