docs(chain): point chain.data-flow.continuity at where the check actually is

[y1o1]

Summary

chain.data-flow.continuity's note claimed the invariant was

baked into provin.oss packages/vc as a contract (the chain invariant in
credential.go / VerifyChain)

Three things were off, and the last one is the reason this is a defect rather
than a typo:

claim	actual
packages/vc	provin.oss is a Go module with no packages/. Every other note here already writes vc/claim.go, vc/cryptosuite.go
VerifyChain in credential.go	Verifier.VerifyChain lives in vc/verifier.go
one file	two different things. vc/credential.go states the invariant (doc comment on the credential type); vc/verifier.go:495 enforces it (ps.OutputHash != cs.InputHash)

A reader following the note to check that the spec is actually implemented needs
the second one. A note that cannot be followed to the code is the failure mode
this catalog exists against.

-      "Input-output binding"; baked into provin.oss packages/vc as a contract
-      (the chain invariant in credential.go / VerifyChain). Resolved the
+      "Input-output binding"; baked into provin.oss's vc package as a contract
+      — the invariant is stated on the credential type in vc/credential.go and
+      enforced by Verifier.VerifyChain in vc/verifier.go. Resolved the

Test plan

• tools/lint.py green — 242 rules, 0 todo
• Both paths verified to resolve against provin.oss main (now public)
• grep -rn 'packages/' rules/ is empty: this was the only occurrence

Normative text unchanged — statement, uses, vectors and status are
untouched; this is the notes field only.

🤖 Generated with Claude Code