Align Scient product and owned source truth

[yaacovcorcos]

Summary

• make the accepted PRD explicit about the Scient product and the technical roles of ScientFactory/Scient, scient-desktop, and scient-agent
• add a machine-readable owned-source manifest and parent CI verification against both public source repositories' current default-branch heads and review state
• align the human source lock with the final desktop and agent maintenance merges, hosted CI, monitor, and packaged-artifact evidence
• pin the parent evidence workflow actions to immutable release SHAs and document the strict reviewed-tip command

Verification

• node --test lab/scripts/verify-owned-sources.test.mjs (7 tests)
• node lab/scripts/verify-owned-sources.mjs
• node lab/scripts/verify-gate-1-5-manifest.mjs
• git diff --check origin/main...HEAD
• independent review against current origin/main

Boundaries

• scient-agent remains the maintained source foundation for a planned native Scient agent; this PR does not claim that runtime exists
• the exact-head desktop DMG is locally buildable and the isolated project-init flow was exercised, but the artifact is not distribution-signed; public release remains blocked by scient-desktop issue docs: finish governance cleanup #6
• GitHub cannot enforce branch protection on this private parent repository under the current account plan