charon-ml, aeneas: declare GithubRepo provenance — both were UNSCANNED

The nightly scan's second warning line (below the CPE-coverage one) reports:

    ⚠ 35 package(s) emitted NO vuln query (no OSV ecosystem, no GitHub repo,
      not GnuProject/Sourceforge) — UNSCANNED, reported as 0 findings

That is a strictly worse class than "queried, found nothing": these packages
were never asked. charon-ml and aeneas are on that list, and both have a plain
GitHub upstream that just was never declared.

  charon-ml → AeneasVerif/charon   (Apache-2.0, confirmed via API)
  aeneas    → AeneasVerif/aeneas   (Apache-2.0, confirmed via API)

Both sources are gs://-mirrored, and `Provenance::from_url` deliberately
declines gs:// — so nothing could infer these; they had to be declared.

Neither currently resolves any advisory (OSV GIT query returns 0 for both
repos, checked today), so this changes no finding today. That is the point: a
queried zero is an answer, an unqueried zero is not. From here they ride the
OSV GIT / GHSA path like every other GithubRepo package.

Verified with `pkgmgr check-onboarding` against this branch: 80 gaps -> 78, and
neither package appears in the output any more.

## The other three could NOT be fixed, and the reason matters

menhir, visitors and unionfind are also on the unscanned list. All three are
fpottier projects on gitlab.inria.fr, and each build.ncl header already says:

    "no `Gitlab` provenance category yet — minimal-supply-chain#347"

That category HAS since shipped on the tooling side (sc#347/#348 + pm#511):
`Provenance::Gitlab { host, owner, repo }` exists in the Rust parser and
scan.rs routes it. But the minimal STDLIB contract never got it. From the
stdlib in use (`attr_classes.ncl`), the accepted set is exactly:

    'GithubRepo   'GnuProject   'Sourceforge   'Website

Declaring 'Gitlab under `| Attrs` therefore fails the contract outright —
`minimal dump` aborts with "failed to validate source_provenance" and the WHOLE
package set fails to evaluate, not just that package.

psmisc appears to contradict this: it ships `category = 'Gitlab` on main today.
It does not — psmisc's attrs block carries NO `| Attrs` annotation, so it is
never contract-checked. That is an accident, not a pattern to copy, and it means
we currently have one package whose provenance the contract has never seen.

So the pkgs half of the GitLab provenance work was never merely forgotten — it
was not expressible. Raising the stdlib gap is a minimal-side decision, so this
PR stops at the two packages that can land today rather than working around a
contract.

Author: bryan-minimal

packages/aeneas/build.ncl

@@ -68,6 +68,11 @@ let version = "20260713" in
   attrs =
     {
       upstream_version = version,
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "AeneasVerif",
+        repo = "aeneas",
+      },
       license_spdx = "Apache-2.0",
     } | Attrs,
   tests = {

packages/charon-ml/build.ncl

@@ -66,6 +66,11 @@ let version = "0.1.223" in
   attrs =
     {
       upstream_version = version,
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "AeneasVerif",
+        repo = "charon",
+      },
       license_spdx = "Apache-2.0",
     } | Attrs,
   tests = {