Separate display authors from verified agent provenance

For agent-authored shared knowledge, keep editable display authors separate from verified private provenance. Cosmos now signs the authenticated principal and its exact durable pre-call audit UUID into Forum creation calls; Forum verifies it, stores first-write provenance privately, and fails closed rather than silently downgrading when audit or signing is unavailable.

Provenance: https://github.com/e3-solutions/forum/pull/1 and https://github.com/e3-solutions/e3-mcp/pull/38