feat(web): surface per-identity provenance in the mapping editor

[tdejager]

Why

Schema v3 (#224) publishes an identities array for every package, and the browser loader already validates all of it — role, provenance source, confidence, the evidence the pipeline used, and the primary's review block. None of it reaches the screen. A reviewer opening a package sees one status pill and has no way to tell whether the primary PURL was set by a person or guessed by the pipeline.

The distinction is the point. The package-level mapping status and a primary identity's review.status are different facts: a human-blessed mapping routinely contains an automatically derived, individually unreviewed primary. In the current corpus that is 682 packages with status: verified whose primary PURL is auto / auto-unverified, plus 2 more where it is auto-verified. Rendering either as a stand-in for the other tells reviewers something untrue about who vouched for what.

What changes

• Adds an Identity provenance section to the mapping editor listing every published identity: the PURL or CPE chip, its role (primary / alt / cpe), its provenance source, confidence when published, the evidence sources behind an automatic primary, and — primaries only — its own review badge.
• Keeps the two review facts apart. The mapping status pill stays where it is; identity review badges are visually distinct and an automatic identity never renders as human-verified. Where the mapping claims human review the primary identity does not have, the section says so in one line instead of leaving the reader to spot it.
• Puts the semantics in a plain module (web/src/data/identityProvenance.ts) that turns published identities into display descriptors, so the rules are testable without a DOM and the component stays presentational.
• Degrades quietly: v2-era packages without identities render no section at all, and identities the payload marks provenance-unavailable (bare alternatives, CPEs) say "no provenance recorded" rather than showing a default confidence or review state.
• While a local draft is open the rows are labelled as last-published, since the editor above may already disagree with them.

Display only — no change to the payload, the loader, or the contribution flow.

Testing

• npm test in web/: 8 new tests alongside the existing loader suite, covering a manual verified primary (names its reviewer), an auto-unverified primary (shows confidence, renders no reviewer and no human-verified wording), a recipe-source alternative (provenance without a review state), the verified-mapping / auto-primary divergence, absent and provenance-less identities, and the stale-draft label. They render the real component through Vite's SSR loader, the same way the existing loader tests load modules.
• npm run build (tsc --noEmit + vite build) clean.
• Smoke-rendered against a locally regenerated v3 payload (33,726 packages) for one package of each corpus shape: aardvark-dns (verified mapping, auto-unverified primary — divergence callout), a2a-sdk (manual verified primary plus a provenance-less alternative), 21cmfast (auto-verified primary with evidence sources), pikepdf (verified mapping, auto-verified primary), automake (CPE-only), 7za (no identities — section hidden). No generated payload files are committed.

One pre-existing failure in web/src/data/loader.test.mjs is untouched by this PR: the checked-in snapshot test asserts a 33,287-package count while web/public/mappings-index.json on main now holds 33,726, so it fails on main as well. No CI workflow currently runs the web test suite.

🤖 Generated with Claude Code