fix(provenance): reject a ref-type on a non-Azure-DevOps origin

[gosharplite]

Fixes #54.

ADR-0019 and docs/10-vendoring.md both say modelith-ref-type applies only to Azure DevOps and is omitted for GitHub, but Header.validate (internal/provenance/provenance.go) only checked that the value was one of branch/tag/commit — never which origin it appeared on.

The fix

validate now reports a ref-type on any origin but dev.azure.com. The host set is closed, the same posture as an unknown fetch: method — a ref-type on a host whose API resolves an untyped ref on its own is a defect, not a value to ignore. Because deps refuses a header carrying any problem, this also stops deps update from silently dropping the key (recordedRefType returns "" for GitHub).

Placed in validate rather than the lint layer so every consumer agrees: modelith lint surfaces it as a provenance finding, and deps check/deps update refuse the header instead of acting on it.

Before / after (the issue's exact repro)

A GitHub-origin header with the key:

$ modelith lint gh-reftype.modelith.yaml
# before: 0 error(s), 0 warning(s)
# after:
  error   [semantic] (root): provenance header: line 6: provenance ref-type "tag" is recorded only for a dev.azure.com origin, and this file's origin is "https://github.com/acme/billing" — a host whose API resolves an untyped ref on its own carries no ref-type key; remove the line

A legitimate ADO header (origin dev.azure.com, ref-type: branch) and a GitHub header without the key both still lint clean (0 error(s), 0 warning(s)).

Review follow-ups (3 commits)

An independent architecture review ran three rounds on this branch. Round 1 and 2 raised findings, both addressed:

• 98c498c — originHost now uses url.Hostname(), so an origin written with an explicit port (dev.azure.com:443) is not read as a different host; TestParse_Valid is table-driven over the ADO and GitHub header shapes.
• d781627 — round 2 found that the above made internal/provenance and internal/deps disagree (provenance stripped the port, deps kept it), so a hand-written ported ADO origin passed lint but deps check refused it. Host normalization now has a single source of truth: provenance.NormalizeHost / provenance.OriginHost, consumed by ParseSource and sourceFromHeader; deps' duplicates are deleted.

Round 3 came back clean.

Tests

• TestADR_0019_RefTypeIsOnlyValidOnAnADOOrigin (provenance) — a GitHub origin carrying the key is rejected (problem names the origin and points at the key's line); a GitHub header without the key, and an ADO origin with an explicit port, both parse clean.
• TestVendored_RefTypeOnAGitHubOriginIsReported (lint) — the rule surfaces through modelith lint as a SeverityError, reproducing the issue.
• TestOriginHost (provenance) and ported GitHub/ADO cases in the deps parse tables — pin the shared normalizer.
• The vendored fixture carried the key on a GitHub origin — itself the defect — so its origin is now Azure DevOps.

Verification

go build ./..., go vet ./..., staticcheck@v0.7.0, and golangci-lint@v2.12.2 (0 issues) clean; go test -race ./... passes; lint-models and render-check green (no golden drift). The #54 repro and the ported-origin case were both checked against the built binary.