feat(cache): add rebuild and provenance safeguards

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

src/repo_manager/observe.py

@@ -7,6 +7,7 @@ from pathlib import Path
 
 import yaml
 
+from repo_manager.cache import source_fingerprint
 from repo_manager.classification import require_valid_classification
 from repo_manager.gitops import head_sha, is_git_repo
 from repo_manager.index_store import RepoIndex, WorkRecordEntry, _now
@@ -117,11 +118,14 @@ def observe_repository(repo_root: Path, *, slug: str | None = None) -> tuple[dic
             )
 
     sha = head_sha(repo_root) if is_git_repo(repo_root) else None
+    fingerprint, source_files = source_fingerprint(repo_root)
     index = RepoIndex(
         slug=slug,
         repo_root=str(repo_root),
         head_sha=sha,
         observed_at=_now(),
+        source_fingerprint=fingerprint,
+        source_files=source_files,
         work_records=records,
     )