Preserve multi-source provider provenance

[konojunya]

Summary

• accept provider-pack schema 1.0 and 1.1 while preserving the local-only redistribution boundary
• validate additional archive identities, per-icon source references, and per-brand guidance
• preserve safe namespaced gradients, gradient inheritance, clip paths, masks, and integer-normalized view boxes
• expose exact source provenance and brand links in native and WebAssembly render notices
• update the bundled theme pin and prepare @stack-sh/engine 0.6.0

Depends on stack-sh/theme#11.

Validation

• cargo test --all-features --locked
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo fmt --all --check
• RUSTDOCFLAGS=-D warnings cargo doc --all-features --no-deps --locked
• python3 scripts/validate-svg.py
• git diff --check

No provider artwork is embedded in native, WebAssembly, or npm artifacts.