Expose pipeline profile selection and provenance

docs/internal/manifest.md

@@ -113,6 +113,7 @@ does not turn incidental canonical bytes into manifest authority.
 `manifest.RunManifest` is created for each invocation and records:
 
 - invocation identity and `force` flag
+- the selected profile (when any) and secret-free effective configuration digest
 - requested stages
 - per-stage action (`run` or `skip`)
 - per-stage status
@@ -233,6 +234,15 @@ after such a private content change.
 Session manifest is the authoritative stage-progress ledger across invocations.
 Run manifest is invocation-scoped audit state.
 
+Both manifests retain the most recently resolved invocation's bounded
+configuration provenance. It identifies the selected profile name and source
+(`default` or `cli`) plus the effective configuration digest, but never a raw
+secret or profile content. This provenance is informational: it does not
+participate in stage resume or cache decisions. A profile change therefore
+invalidates only stages whose semantic configuration changed. When a private
+external-tool model, module, prompt, or profile changes behind an unchanged
+configured identifier, use `--force` for the affected work.
+
 `session plan` computes the same current fingerprint and applies the same
 comparison and invalidation rules to a cloned manifest. It predicts the runner
 decision without persisting session or invocation state. The shared helper