Files Changed: render the unified lineage ledger

Acceptance Criteria

• Full-provenance sessions render only server-projected lineage-ledger data, not inferred tool or watcher ownership.
• Each canonical resource appears once with final state, origin mix, source-session provenance, receipt count, and evidence state.
• Expanding a resource exposes chronological receipt and assessment history without rewriting immutable execution facts.
• Unknown-operation receipts render as explicit uncertainty items with no fabricated resource row or patch.
• Added, modified, deleted, reverted, conflicted, unavailable, opaque, and partial states are distinguishable without relying on color alone.
• Paging preserves grouping and origin context across a large root ledger.
• Legacy and post-upgrade-partial sessions display a clear capability label and never imply full historical provenance.
• Keyboard navigation, focus, light theme, and dark theme meet the existing Work Column design contract.

Testing Decisions

• Extend ledger projection and view-model tests for grouping, paging, history, unknown items, assessment revisions, legacy labels, and no-fallback ownership.
• Add browser coverage for keyboard operation and light/dark status semantics.

Key Decisions

• Files Changed stays one file-first surface; historical activity is expanded in place rather than moved to another tab.
• The UI displays server-projected facts and assessments, not local attribution guesses.

Constraints & Invariants

• No host-only capability, path, evidence, or redaction field reaches browser state.
• A zero-net final state never erases the resource's historical receipt row.

Prior Art

• Parent Files Changed: full session-lineage mutation ledger #972
• Existing Files Changed review surface and Work Column contract

Deliberation Resolution

• The top-level page unit is one canonical resource. Resources sort by latest assessment revision then stable resource ID; a rename chain remains one resource identity with display aliases in chronological receipt history.
• Receipt history is independently paged within an expanded resource, ordered by immutable receipt sequence; assessment revisions interleave immediately after the receipt they assess. Unknown Mutation Receipts live in a dedicated chronological uncertainty group and do not consume resource-page capacity.
• Row state uses explicit precedence: immutable execution outcome is always shown; the latest assessment supplies net and evidence state; an unavailable assessment never hides the execution fact. opaque is only an uncertainty-group kind, while partial is an execution outcome and unavailable is an assessment state.
• full, partial, and legacy labels have fixed explanatory text and are selected only by capability discovery. The UI exposes that label in the panel heading and as accessible status text.
• Keyboard behavior is specified as: Tab reaches each filter, resource row, continuation, and unknown item; Enter or Space toggles a resource; Escape returns focus to its row; each status has an accessible name containing execution, assessment, and evidence state. Theme tests assert text and icon contrast in light and dark modes.

Source

Part of #972. Blocked by #1076, #1078, #1079, #1080, and #1081.