Artifact figure provenance — enforce "every figure comes from a tool result"