Prompt provenance after database restore

Stop capture, enrollment, owner workers, and private prompt reads before restoring a database. A backup cannot preserve later deletion events. Do not resume this feature using restored owner checks as evidence of current Clerk status.

Run apps/sirloin/scripts/prompt-provenance-restore-reset.sql against the isolated restored database with psql -X -v ON_ERROR_STOP=1 -f .... Its default transaction rolls back. Review all three zero-count checks, then repeat with -v prompt_restore_apply=true and verify them in a new transaction. Use the maintenance role and record the target, backup boundary, and verification.

The reset scrubs submission metadata, removes parent references, disables enrollment, invalidates owner check generations, and fences existing characters against older media. It preserves minimal owner deletion tombstones, erased request identities, character fences, and existing media. It creates no deletion receipts, gap counts, or analysis records. Re-enrollment and fresh owner verification require a separate deliberate action.

If later PR3 adds derived analysis or a dispatch fence, update the reset and its tests before restoring that schema. This four-table script does not claim to erase a future analysis schema.