Verify build provenance or explicit upstream-prebuilt origin provenance.