Creates or verifies hash-only caller-submitted x402 response provenance records with scoped idempotency and one-time lookup secrets.