Bind workflow judge inputs to trusted step attempts

Why: Compiled workflow critics could resend a prior prompt output after document duty or publication changed across separate model guards.

Evidence: RED cross-guard revocation and retry tests; go test ./... -count=1 and targeted go test -race passed locally before commit.

Impact: Bind materialized prompt bytes to the engine step attempt and responded model receipt; recheck current project sources and epochs before judging, failing closed for unproven or ambiguous output.

Refs: RDM two-trees stage5 W6; stage6 X1 public extension request; W6 independent review P1.

pkg/extension/project_context.go

@@ -112,22 +112,23 @@ type ProjectContextManifestEntry struct {
 // ProjectContextManifest describes the text actually passed to the completion
 // client. Candidate references in a bundle are never listed as included input.
 type ProjectContextManifest struct {
-	ProjectID          core.ID
-	TaskID             string
-	Version            string
-	Watermark          string
-	AuthorizationEpoch string
-	PublicationEpoch   string
-	AttemptID          string
-	Delivery           string // attempted | responded | unknown; never implies user-visible delivery
-	Model              string
-	BudgetChars        int
-	InputSHA256        string
-	Included           []ProjectContextManifestEntry
-	Dropped            []ProjectContextManifestEntry
-	OfferedReferences  []ProjectEvidenceRef
-	ReadEvidence       []ProjectContextManifestEntry
-	Missing            []string
+	ProjectID             core.ID
+	TaskID                string
+	Version               string
+	Watermark             string
+	AuthorizationEpoch    string
+	PublicationEpoch      string
+	AttemptID             string
+	WorkflowStepAttemptID string
+	Delivery              string // attempted | responded | unknown; never implies user-visible delivery
+	Model                 string
+	BudgetChars           int
+	InputSHA256           string
+	Included              []ProjectContextManifestEntry
+	Dropped               []ProjectContextManifestEntry
+	OfferedReferences     []ProjectEvidenceRef
+	ReadEvidence          []ProjectContextManifestEntry
+	Missing               []string
 }
 
 type WorkCompletionResult struct {