Recheck project workflow sources without storing prompts

Why: Goal-sensitive workflow verification persisted model prompts and prior output text in trusted receipt rows, while cross-step model inputs could reuse stale machine output.

Evidence: RED receipt privacy test; full Go suite, targeted race, isolated PostgreSQL store/runmgr/storage-migrate tests, vet, and static build passed locally before commit. A known unrelated TempDir cleanup flake failed once and passed on targeted and serial full replay.

Impact: Add optional same-provider source recheck, verify every included item and evidence body before reuse, gate cross-step outputs, reject unsettled attempts, remove raw scope columns, scrub isolated candidate v34 SQLite/PG schemas, and reject unsafe backups.

Refs: Approved RDM stage6 W6 source-recheck design adjustment r1; W6 independent review.

internal/app/project_context.go

@@ -118,6 +118,33 @@ func (s *projectContextSlot) readEvidence(ctx context.Context, req extension.Pro
 	return evidence, nil
 }
 
+func (s *projectContextSlot) recheck(ctx context.Context, req extension.ProjectContextSourceRecheckRequest) (extension.ProjectContextSourceRecheckResult, error) {
+	if s == nil || req.Scope.Actor == "" || req.Scope.ProjectID == "" || req.Scope.Goal != "" {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: trusted source recheck scope missing")
+	}
+	s.mu.RLock()
+	p, holder := s.provider, s.holder
+	s.mu.RUnlock()
+	rechecker, ok := p.(extension.ProjectContextSourceRechecker)
+	if !ok {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: project source rechecker unavailable")
+	}
+	req.Scope.PluginID = holder
+	bounded, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	result, err := rechecker.Recheck(bounded, req)
+	if err != nil {
+		return extension.ProjectContextSourceRecheckResult{}, err
+	}
+	if err := bounded.Err(); err != nil {
+		return extension.ProjectContextSourceRecheckResult{}, err
+	}
+	if result.Bundle.ProjectID != req.Scope.ProjectID || result.Bundle.Status != extension.ProjectContextReady {
+		return extension.ProjectContextSourceRecheckResult{}, errors.New("extension: project sources no longer authorized")
+	}
+	return result, nil
+}
+
 const workContextBudgetChars = 12000
 
 // TaskCreateForWork fixes the project binding while the authenticated command