feat: refuse a label file whose rows carry no provenance

F-01's target was 'every scored label carries provenance', and the fields
existed but nothing enforced them: a v1-style file with no 'source' loaded
exactly like the audited one, which is how 23% wrong labels went unnoticed.

load_labels now refuses such a file by name and index. The v2 labels load
unchanged; a stripped copy is refused. 3 tests. Suite 281 -> 284.

recognization/code/eval_identity.py

@@ -81,10 +81,28 @@ LEAK_SIGNATURE_MAD = 20.0
 
 
 def load_labels(path: str) -> Dict[str, Any]:
+    """Load a label file, refusing one whose rows carry no provenance.
+
+    F-01: the v1 labels were wrong on 23% of facings and nothing in the file
+    said where any of them came from, so a bad label was indistinguishable from
+    a good one. Every row must now name its `source`; a row that cannot be
+    traced is a row that cannot be argued with.
+    """
     with open(path) as handle:
         payload = json.load(handle)
     if not isinstance(payload, dict) or "facings" not in payload:
         raise SystemExit(f"{path}: expected {{'image', 'facings': [...]}}")
+    missing = [
+        row.get("index", i)
+        for i, row in enumerate(payload["facings"])
+        if not row.get("source")
+    ]
+    if missing:
+        raise SystemExit(
+            f"{path}: {len(missing)} facings carry no 'source' "
+            f"(first: index {missing[0]}). A label without provenance cannot be "
+            "audited; see the enrollment protocol in DECISION.md."
+        )
     return payload