Prepare Townlight Records beta fixtures and provenance

[scottconverse]

What

Prepares the Records module for the Townlight Records public beta:

• replaces three unsafe, unprovenanced faux-municipal files with 11 independently authored, CC0 Redstone Valley scenarios
• pins every artifact by byte size and SHA-256 and validates provenance, licensing, watermarks, references, reserved contact data, and secret patterns
• preserves connector source_path and metadata through manual-drop and retry/new-record ingestion into CivicCore
• adds adversarial corpus tests and an exact deterministic validator
• repairs the cross-platform frontend test entry point so both npm test and the historical npm test -- --run audit command execute Vitest and Playwright without forwarding an invalid option

Local verification

• python scripts/validate_synthetic_records.py: PASS (11 deterministic scenarios)
• synthetic corpus tests: 9 passed
• focused ingestion/provenance tests: 20 passed
• backend changed-surface Ruff: PASS
• frontend exact audit command: 42 Vitest + 2 Playwright passed
• frontend production build: PASS
• npm audit at moderate threshold: 0 vulnerabilities
• backend collection: 652 tests collected
• secret-pattern scan: PASS
• real-city marker scan over test-data/**: PASS
• git diff --check: PASS

Docker is not installed on the development machine, so the database-backed full backend suite and Compose runtime proof are intentionally left to the repository's pull-request CI. This PR must remain draft until those checks are green.

Boundaries

This does not publish a release, alter Azure, sign an installer, auto-redact records, remove human approval, or claim that the Python service is already the Townlight desktop execution path.