fix(lexicon): retract two false provenance claims, reach 83/83 to source

The lexicon was seeded from a transcribed dump. With the source module now
readable read-only at b0de0ca on the public remote, it was imported in Node
and compared entry by entry - RegExp source, flags, label, family, array
order. That check contradicted the file twice, in mirror-image ways.

The file claimed it had rewritten raw code points into \uXXXX escapes in
homoglyph:cyrillic-latin-mix and unicode:zero-width-in-word, and carried
byte_identical_to_source: false for both. The module already writes them
escaped. Nothing was ever rewritten. The stored pattern text was correct
throughout - only the account of its origin was wrong, because the dump had
rendered the module's escapes as the characters they denote and this
repository escaped them back.

The same inversion ran the other way in multi-lang:french, which stored a raw
accented Latin e where the module writes the é escape. That was the one
pattern of 83 not byte-identical to source, and it is corrected here, making
it 83/83. Both spellings are the same regular expression: compiled in Node
bare and under u, and in Python re, over accented, unaccented, uppercase and
non-matching French input, with identical match offsets. No behaviour moved.

Exactly one pattern entry differs from HEAD, and no pattern in the file
contains a non-ASCII byte any more - which matches the module, whose regex
literals are ASCII throughout. A third claim fell with them: the translation
note asserting that the leetspeak and multi-language patterns embed accented
Latin directly was wrong in both halves.

normalisations is now [] with a normalisations_note, the convention already
in signatures/secret-egress.json. A new source_fidelity block carries the
counts, the method, the verified class membership, and both retractions in
full - retracted, not deleted. The equivalence evidence behind the withdrawn
claim (692 Node comparisons, 236 Python) is still a true statement about raw
versus escaped; it is just no longer load-bearing.

Provenance upgraded accordingly: source_commit pinned, and the caveat saying
these checks only proved agreement with a dump is gone, because they no
longer do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNMcqrfNyoLRQ7qXUFZnb9

CHANGELOG.md

@@ -53,6 +53,35 @@ checks that were not run instead of attaching a caveat to a pass.
 
 ### Changed
 
+- `lexicon/injection-lexicon.json` **0.3.0 → 0.4.0** — verified against the source module
+  instead of against the dump it was transcribed from, and **two false provenance claims
+  retracted**. The source is now pinned: `b0de0ca` on the public remote, imported in Node
+  and compared entry by entry on `source`, `flags` and `label`.
+
+  The result is **83/83 byte-identical to source**, which is not what the file previously
+  claimed. It said two patterns had been rewritten from raw code points into `\uXXXX`
+  escapes; the module already writes them escaped, so nothing had been rewritten. The stored
+  pattern text was right the whole time — only the account of where it came from was wrong.
+  The dump had rendered the module's escapes as the characters they denote, and this
+  repository re-escaped them, arriving at the correct bytes by way of an incorrect story.
+
+  The same inversion ran the other way in `multi-lang:french`, which carried the class
+  spelled with a raw accented Latin `e` where the module writes it as the escape
+  `\u00e9` inside the same character class.
+  That was the one pattern of 83 not byte-identical to source,
+  and it is corrected. The two spellings are the same regular expression — verified in Node
+  bare and under `u`, and in Python `re`, over accented, unaccented, uppercase and
+  non-matching French input, with identical match offsets — so **no behaviour moved**. No
+  pattern in the file contains a non-ASCII byte now, matching the module, whose regex
+  literals are pure ASCII throughout.
+
+  Structurally: `normalisations` is now `[]` with a `normalisations_note`, matching the
+  convention already used in `signatures/secret-egress.json`, and a new `source_fidelity`
+  block carries the counts, the method, the verified class membership, and both retractions
+  in full. Retracted claims are recorded rather than deleted — the earlier equivalence
+  evidence (692 Node comparisons, 236 Python) remains true, it is simply no longer
+  load-bearing.
+
 - `lexicon/injection-lexicon.json` **0.2.0 → 0.3.0** — the two aliases are no longer presented
   as equally backed. `pattern_id_space.alias_evidence` now records each one separately:
   `llm_ingestion_guard` is **verified** (the guard's coverage matrix asserts on that exact