Separate public source identity from private evaluator trace identity

For durable call evaluation, use two hashes with explicit semantics: a public source_hash over the canonical call envelope for catalogue/provenance, and a private trace_hash = content_hash(raw universal_context) for pre-grade mutation detection. Register only call_id plus those hashes through one immutable service-role RPC; return only the manifest ID/digest publicly. Batch re-fetch must compare against the raw universal_context boundary rather than a legacy repository representation that enriches metadata, or identical source data will hash differently. Observed in ender-inference COR-4066 / PR #141 at 2026-09-06T20:41Z; provenance commit 9458c65 and the batch cross-contract review.