Reference inventory can bind a staged blob to the wrong commit

Problem

reference_inventory.py inventory records the current HEAD commit but reads tracked source entries from the Git index. A staged edit can therefore put a blob that is absent from the recorded commit into the inventory and its verification receipt.

Reproduction

1. Create a Git repository with a committed src/kernel.h and run the production reference_inventory.py inventory command.
2. Modify and stage src/kernel.h without creating a new commit.
3. Run inventory again, scaffold a ledger, and run verify --source-root.

Expected and actual behavior

The inventory and verification receipt should use the file and blob OID from the fixed source commit recorded in the inventory. Instead, HEAD remains the original commit while the inventory records the staged blob; verification succeeds with no errors because it reads the same index state.

Impact

A verification receipt can attribute content that is not present in the named upstream commit to that commit, making source evidence inaccurate and non-reproducible.

Fix

Build inventory entries from the tree of the recorded commit and verify against that same commit tree. Add a production CLI regression covering clean and staged source states.

Validation

The focused regression passed. The source resource test suite passed with 34 tests and one skipped test for an unavailable pinned operator snapshot; Ruff and git diff --check also passed.

关联 PR: https://gitcode.com/cann/cannbot-knowledge/merge_requests/79