Base-image attribution confidence/unknown state on BUILT_FROM

[toddysm]

Part of #168 (gap analysis bucket 3c: base lineage).

Problem

BUILT_FROM records base repo+digest+tag and a runUrl, but has no explicit confidence or unknown state. #168 requires recording provenance/evidence and an explicit confidence/unknown state when exact base attribution is unavailable.

Scope

• Add a confidence/unknown attribution field (and evidence reference) to BUILT_FROM.
• Ensure bases/derived queries surface the confidence/unknown state.

Acceptance criteria

• BUILT_FROM carries confidence/unknown + evidence.
• Queries/visualization surface it; tests + docs updated.