S5.3 drill (2nd pass): anchor refactor-equivalence provenance to git history

The previous drill's equivalence theorems were only as strong as their
RHS matching the ACTUAL historical base (not a from-memory
reconstruction) and 'nothing else changed' being true. Both now verified
against the repository itself: git show cfde9b2 confirms the RHS forms
verbatim; git diff cfde9b2..8795e82 confirms the refactor is base-only
(eight lines). Provenance recorded in Refactor.lean's header so the
argument is self-contained: unchanged remainder (git) + equal base
(kernel) => whole-function equality. 26 certs green. LTL untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

verification/Proofs/Refactor.lean

@@ -3,7 +3,13 @@
    SEMANTICS-PRESERVING — Opus's only evidence was "the chain recompiled".
    These two theorems machine-check the equivalence against the exact
    list-match forms that were replaced, so the refactor's faithfulness is
-   a permanent, cone-audited guarantee. -/
+   a permanent, cone-audited guarantee.
+
+   PROVENANCE (verified against git history, not memory): the RHS forms
+   below are verbatim the base of `ConsRec` at commit cfde9b2 (pre-
+   refactor), and `git diff cfde9b2 8795e82 -- Proofs/Basic.lean` shows
+   the refactor touched ONLY those eight base lines. Unchanged remainder
+   (git) + equal base (kernel) = the whole function is unchanged. -/
 import Proofs.Basic
 
 namespace LTLAcc