fix: branch resolution

[SionoiS]

My AI found this. Let me know what ya think.

Root cause: Log::verify never set Comrade’s domain, so branch("pubkey") always resolved under "/".

Change in crates/provenance-log/src/log.rs: before unlock/lock, set domain from the entry ops context (longest common branch):

let domain = entry.context().to_string();
let mut unlocked = match Comrade::new(&kvp_lock, &entry)
    .with_domain(&domain)
    .try_unlock(unlock)

That matches the README’s Mike/Walker model: lock at /delegated/, ops under /delegated/mike/ → branch("pubkey") → /delegated/mike/pubkey. Unlock scripts still use absolute paths, so setting domain before unlock is safe.