fix: bind upstream caches to immutable server identity

[imran-siddique]

Summary

Key per-session stdio child pooling by executable, arguments, measurement target, and pinned digest. Key cached provenance verdicts by that execution/network identity plus the configured provenance record and publisher key.

Root cause

Both caches previously used server.display_name, a human-readable catalog label that is not required to be unique. Distinct approved servers sharing a label could therefore reuse the first server's spawned process or provenance verdict.

Validation

• Added regression coverage showing equal labels with different endpoints do not collide
• Verified the same server identity is still shared across multiple tools
• Verified different publisher authorities cannot share provenance cache entries
• Focused proxy/provenance tests: 50 passed
• Full clean-environment suite: 1053 passed, 8 skipped
• Ruff, mypy, and Bandit: clean
• git diff --check: clean

Documentation

• Documented stdio and provenance cache identity requirements
• Added an Unreleased security changelog entry