feat: wire field_contract into product enrichment; auto-discover CRT/CONTRIBUINTE_IPI at heartbeat; targeted per-product ERP evidence

field_contract.resolve_product was only exercised by its own unit tests. /v1/products/resolve now calls it for every product whose NCM
resolves, merging CFOP/CST/CSOSN/PIS-COFINS/CST_IPI/SITUACAO_TRIBUTARIA/IAT/IPPT decisions alongside CLASSIFICACAO_FISCAL/CEST/IPI - reusing
the same engine, the same FiscalContextEntry table the blocker-resolution workflow already writes to, no duplicated rules.

Closes three real transport/discovery gaps found while wiring it in:
- Agent heartbeat never sent company_crt (env-var UF only) or company_contribuinte_ipi, so Installation.company_crt stayed permanently empty
  even though company_context.resolve() already proves both from C000004/EMISSOR for every coverage job. Resolved once, cached, retried only
  while unresolved. Migration 0032 adds Installation.company_contribuinte_ipi (NULL=unknown, never coerced to "N").
- The Agent's enrichment payload only ever reported 3 old fields (CLASSIFICACAO_FISCAL/CEST/IPI) as "current", so the Hub could never see the
  product's own CFOP/CST/CSOSN/... nor the classification columns (TIPO/PROD_COZINHA/PRODUTO_SERVICO/CODGRUPO) infer_role needs - separated
  into a read-only CURRENT_REPORT_FIELDS list, the write allowlist (PRODUCT_ENRICHMENT_WRITE_V1) untouched.
- Added a targeted, product_code-scoped evidence query (firebird_reader.read_product_evidence: recipes/composed/purchases/stock, indexed WHERE,
  never a full-table scan) so st_withheld/product_role can be proven for a single ad-hoc resolve, not only during a full sync job.

Verified read-only against the real database (D:\PROJETOS\GTISISTEMAS\Banco\GTI.FDB): CRT=1, CONTRIBUINTE_IPI=N, company_context.resolve()
reaches HIGH confidence; infer_role correctly resolved RESALE/OWN_PRODUCTION for 5/8 sample real products with zero operator questions.

1121 tests passed (tests + central/tests + agent/tests), 0 failed. Version 1.3.7 (single GTI_FISCAL_VERSION shared by Hub and Agent per
central/app/version.py's own design - never independently versioned).

agent/tests/test_company_context.py

@@ -83,6 +83,23 @@ def test_optante_inconsistency_is_a_warning_not_a_guess():
     assert r["status"] == "PASS" and any("OPTANTE_SIMPLES" in w for w in r["warnings"])
 
 
+def test_contribuinte_ipi_is_auto_discovered_from_the_same_selected_c000004_row():
+    """C000004.CONTRIBUINTE_IPI (real column, same row already proven to be THE company by CRT/UF resolution) closes the fiscal-completion gap
+    where CST_IPI could not be resolved without asking an operator for a fact the ERP already proves."""
+    row = co("000001", CN_A)
+    row["contribuinte_ipi"] = "N"
+    r = resolve(ev([row], [emis()], DOC_A))
+    assert r["company_contribuinte_ipi"] == "N" and r["source_of_truth"]["contribuinte_ipi"] == "C000004"
+
+
+def test_contribuinte_ipi_absent_or_invalid_stays_unresolved_never_guessed():
+    r = resolve(ev([co("000001", CN_A)], [emis()], DOC_A))         # co() never sets contribuinte_ipi
+    assert r["company_contribuinte_ipi"] is None
+    row = co("000002", CN_B); row["contribuinte_ipi"] = "X"        # garbage value: never trusted
+    r2 = resolve(ev([row], [emis(cnpj=CN_B)], [{"cuf": "29", "cnpj": CN_B, "n": 1}]))
+    assert r2["company_contribuinte_ipi"] is None
+
+
 def test_full_cnpj_is_never_exposed():
     r = resolve(ev([co("1", CN_A)], [emis()], DOC_A))
     dump = str(preflight_report(r)) + str(r)