store: protected nodes, explicit provenance in mutations

- Add protected_nodes config list - blocks delete/rename of core nodes
- Remove current_provenance() env var lookup, pass provenance explicitly
- delete_node, rename_node, set_link_strength now take provenance param
- Fix new_relation calls in admin.rs to pass "system" provenance

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/config.rs

@@ -78,6 +78,9 @@ pub struct Config {
     #[serde(deserialize_with = "deserialize_path")]
     pub projects_dir: PathBuf,
     pub core_nodes: Vec<String>,
+    /// Nodes that cannot be deleted or renamed without --force
+    #[serde(default)]
+    pub protected_nodes: Vec<String>,
     pub journal_days: u32,
     pub journal_max: usize,
     pub context_groups: Vec<ContextGroup>,
@@ -146,6 +149,7 @@ impl Default for Config {
             identity_dir: home.join(".consciousness/identity"),
             projects_dir: home.join(".claude/projects"),
             core_nodes: vec!["identity".to_string(), "core-practices".to_string()],
+            protected_nodes: Vec::new(),
             journal_days: 7,
             journal_max: 20,
             context_groups: vec![