feat(provenance): govern source snapshots and data inputs

backend/tests/test_auth.py

@@ -154,6 +154,7 @@ def test_guest_login_exposes_models_but_rejects_management_and_cross_project_req
     other_project = client.get("/api/v1/projects/00000000-0000-0000-0000-000000000999")
     detection_models = client.get("/api/v1/detection/models")
     segmentation_models = client.get("/api/v1/segmentation/models")
+    global_source_registry = client.get("/api/v1/source-registry/grb")
     cross_project_runs = client.get(
         "/api/v1/detection/runs?project_id=00000000-0000-0000-0000-000000000999"
     )
@@ -179,6 +180,8 @@ def test_guest_login_exposes_models_but_rejects_management_and_cross_project_req
     assert detection_models.status_code == 200
     assert detection_models.json()["data"]["models"]
     assert segmentation_models.status_code == 200
+    assert global_source_registry.status_code == 403
+    assert global_source_registry.json()["error"] == "GUEST_ROUTE_NOT_AVAILABLE"
     assert cross_project_runs.status_code == 403
     assert cross_project_runs.json()["error"] == "GUEST_PROJECT_SCOPE_REQUIRED"
     assert cross_project_coverage.status_code == 403
@@ -186,7 +189,7 @@ def test_guest_login_exposes_models_but_rejects_management_and_cross_project_req
 
 
 def test_guest_session_tokens_fail_closed_without_a_project_scope(monkeypatch) -> None:
-    client = auth_client(monkeypatch, guest_access=True)
+    auth_client(monkeypatch, guest_access=True)
     settings = get_settings()
 
     try: