fix(research): bind price proxy exports to consumed sources

[Pigbibi]

The Nasdaq/S&P price-proxy exporter parsed source CSVs before hashing their paths. If a source changed during transformation, a successful export could record input bytes that were never consumed.

Parse and identify both sources from byte snapshots, retain the original path semantics, deduplicate shared targets, and reject source changes before creating output files. The existing research-manifest writer accepts optional consumed input bytes; callers that omit them keep their existing behavior and manifest schema. Price transformation, timestamps, defaults, and runtime policies remain unchanged.

Validation:

• Reproduced the original source-replacement bug before the fix.
• 71 related tests passed, covering normal/shared inputs, replacements, symlink targets and parent paths, and manifest byte identity.
• The local full suite had 101 passes and three failures in the unchanged Linux-only no-clobber publisher. The same three failures were reproduced on exact base 4d8d413 on macOS; Linux CI will validate that path.
• Ruff and git diff checks passed. All fixtures are synthetic; no vendor data was acquired, persisted, or recomputed.