Record reference provenance in manifests

internal/framework/pipeline/runner.go

@@ -356,8 +356,12 @@ func manifestFromPipeline(input RunInput) artifacts.RunManifest {
 		ArtifactLanes:  make([]artifacts.ArtifactLaneManifest, 0, len(pipeline.ArtifactLanes)),
 		RunID:          runID,
 		StartedAt:      timePtr(startedAt),
+		References:     ReferenceProvenance(pipeline),
 		LLMProfiles:    cloneLLMProfiles(input.LLMProfiles),
 	}
+	// The runner does not currently maintain a cache or idempotency key. Reference
+	// digests are recorded in manifest provenance and intentionally kept separate
+	// from source_digests.
 
 	for _, lane := range pipeline.ArtifactLanes {
 		laneManifest := artifacts.ArtifactLaneManifest{