feat: wire field_contract into product enrichment; auto-discover CRT/CONTRIBUINTE_IPI at heartbeat; targeted per-product ERP evidence

field_contract.resolve_product was only exercised by its own unit tests. /v1/products/resolve now calls it for every product whose NCM
resolves, merging CFOP/CST/CSOSN/PIS-COFINS/CST_IPI/SITUACAO_TRIBUTARIA/IAT/IPPT decisions alongside CLASSIFICACAO_FISCAL/CEST/IPI - reusing
the same engine, the same FiscalContextEntry table the blocker-resolution workflow already writes to, no duplicated rules.

Closes three real transport/discovery gaps found while wiring it in:
- Agent heartbeat never sent company_crt (env-var UF only) or company_contribuinte_ipi, so Installation.company_crt stayed permanently empty
  even though company_context.resolve() already proves both from C000004/EMISSOR for every coverage job. Resolved once, cached, retried only
  while unresolved. Migration 0032 adds Installation.company_contribuinte_ipi (NULL=unknown, never coerced to "N").
- The Agent's enrichment payload only ever reported 3 old fields (CLASSIFICACAO_FISCAL/CEST/IPI) as "current", so the Hub could never see the
  product's own CFOP/CST/CSOSN/... nor the classification columns (TIPO/PROD_COZINHA/PRODUTO_SERVICO/CODGRUPO) infer_role needs - separated
  into a read-only CURRENT_REPORT_FIELDS list, the write allowlist (PRODUCT_ENRICHMENT_WRITE_V1) untouched.
- Added a targeted, product_code-scoped evidence query (firebird_reader.read_product_evidence: recipes/composed/purchases/stock, indexed WHERE,
  never a full-table scan) so st_withheld/product_role can be proven for a single ad-hoc resolve, not only during a full sync job.

Verified read-only against the real database (D:\PROJETOS\GTISISTEMAS\Banco\GTI.FDB): CRT=1, CONTRIBUINTE_IPI=N, company_context.resolve()
reaches HIGH confidence; infer_role correctly resolved RESALE/OWN_PRODUCTION for 5/8 sample real products with zero operator questions.

1121 tests passed (tests + central/tests + agent/tests), 0 failed. Version 1.3.7 (single GTI_FISCAL_VERSION shared by Hub and Agent per
central/app/version.py's own design - never independently versioned).

agent/tests/test_run_agent_service.py

@@ -346,6 +346,64 @@ def test_run_sends_heartbeat_but_never_polls_when_paused_centrally(monkeypatch,
     assert service.AgentState(config.state_db).stored_installation_id() == installation_id
 
 
+def test_company_context_for_heartbeat_resolves_once_and_caches(monkeypatch):
+    """CRT was never sent at heartbeat: the Agent already proves it (company_context.resolve, via preflight_company_context) for coverage/RTC
+    jobs, but that value never reached the Hub. This locks in the fix: resolved once, cached, never re-queried once solid."""
+    calls = {"n": 0}
+
+    def fake_preflight(env):
+        calls["n"] += 1
+        return {"status": "PASS", "company_uf": "BA", "company_crt": "1", "company_code": "000001"}
+
+    monkeypatch.setattr("gti_fiscal_agent.company_context.preflight_company_context", fake_preflight)
+    result, reason = service._company_context_for_heartbeat({}, None)
+    assert result == {"status": "PASS", "company_uf": "BA", "company_crt": "1", "company_code": "000001"} and reason is None and calls["n"] == 1
+    result2, reason2 = service._company_context_for_heartbeat({}, result)      # already cached: never re-queries Firebird
+    assert result2 is result and reason2 is None and calls["n"] == 1
+
+
+def test_company_context_for_heartbeat_retries_while_unresolved_never_guesses(monkeypatch):
+    def fake_preflight(env):
+        return {"status": "FAIL", "classification": "UNRESOLVED", "reasons": ["UF_SOURCE_UNKNOWN"]}
+
+    monkeypatch.setattr("gti_fiscal_agent.company_context.preflight_company_context", fake_preflight)
+    result, reason = service._company_context_for_heartbeat({}, None)
+    assert result is None and "UNRESOLVED" in reason        # never a guessed uf/crt - explicitly unresolved, retried next tick
+
+
+def test_run_heartbeat_carries_the_auto_discovered_company_crt(monkeypatch, tmp_path):
+    """End-to-end: once company context resolves, the CRT rides the heartbeat payload the Hub already knows how to store
+    (Installation.company_crt) - closing the transport gap without any Hub change."""
+    stopper = _ExternalStopFlag()
+    fake_hub = _FakeHubForLoop()
+    installation_id = "00000000-0000-4000-8000-000000000333"
+    sent = {}
+
+    def identity():
+        return {"agent_id": 2, "installation_id": installation_id}
+
+    def heartbeat_metadata(payload):
+        sent.update(payload)
+        stopper.stop = True
+        return {"agent_id": 2, "processing_enabled": False}
+
+    fake_hub.identity = identity
+    fake_hub.heartbeat_metadata = heartbeat_metadata
+    fake_hub.next_job = lambda: (_ for _ in ()).throw(AssertionError("paused centrally; next_job must not be called"))
+    monkeypatch.setattr(service, "HubClient", lambda *a, **k: fake_hub)
+    monkeypatch.setattr(service, "load_executor", lambda: _FakeExecutor())
+    monkeypatch.setattr(service.time, "sleep", lambda _seconds: None)
+    monkeypatch.setattr("gti_fiscal_agent.company_context.preflight_company_context",
+                        lambda env: {"status": "PASS", "company_uf": "BA", "company_crt": "1", "company_code": "000001", "company_contribuinte_ipi": "N"})
+
+    config = _config(agent_id="2", poll_interval_seconds=0, state_db=str(tmp_path / "agent.db"))
+    env = {"AGENT_ID": "2", "FIREBIRD_DATABASE_PATH": AUTHORIZED, "FIREBIRD_WRITES": "0", "FISCAL_MODE": "DRY_RUN"}
+
+    service.run(config, env, stopper=stopper)
+
+    assert sent["company_uf"] == "BA" and sent["company_crt"] == "1" and sent["company_contribuinte_ipi"] == "N"
+
+
 def test_run_honors_an_externally_supplied_stopper(monkeypatch):
     # This is exactly the pattern the Windows Service wrapper uses: it never
     # constructs GracefulStop() (which would crash off the main thread), it