breg: module provenance omits attachment slots, so module-declared slots read as project-root

[jeremi]

What

CompiledEntityModuleOrigins (crates/registry-breg/src/model.rs) carries a per-id origin map for eight of an entity's id-keyed collections: fields, constraints, hooks, derived_relations, indexes, access_profiles, selector_profiles, read_paths. It carries none for attachments, and CollectedOrigins (crates/registry-breg/src/compiler.rs) has no field for them either.

insert_entity walks exactly those eight collections and records (entity id, member id) -> module for each member. It never walks entity.attachments, even though CompiledEntity.attachments is a populated BTreeMap<String, CompiledAttachmentSlot> compiled from the same entity source.

Why it is wrong

The documented invariant on module_origins is:

Which module contributed each id in this entity's id-keyed collections. An id absent from a map was contributed by the project root.

An attachment slot declared by a module is absent from every map, so a consumer applying that invariant attributes it to the project root. The provenance is not merely missing, it is confidently wrong, which is the failure mode the invariant was written to prevent.

This reaches bregctl explain model, whose entities passthrough carries moduleOrigins as compiled.

Fix

Add an attachments: BTreeMap<String, String> map to CompiledEntityModuleOrigins, include it in is_empty, add the matching EntityMemberOriginMap to CollectedOrigins, and populate it in insert_entity beside the other eight. A test asserting that a module-declared attachment slot names its module, alongside the existing per-collection origin tests, is what holds it.

Provenance

Raised by the review connector on PR #1271 and verified against the source before filing. Not introduced by that PR; the gap predates it and is untouched by it.