feat(identify): provenance command (platform + watermark inventory)

New 'identify' command and identify.py module: upload an image, get one
ProvenanceReport answering where it was made and what watermarks it
carries. Aggregates every locally-readable signal:

- C2PA Content Credentials -> generating platform (issuer + generator).
- IPTC digitalSourceType 'Made with AI' (Meta and others).
- Embedded SD/ComfyUI generation parameters (local pipelines).
- SynthID metadata proxy (Google / OpenAI C2PA companion).
- Visible Gemini sparkle (cv2 fallback for the stripped-metadata case),
  promoted only at confidence >= 0.5 (corpus-tuned: Gemini sparkles
  score >= 0.56, non-sparkle <= 0.49).

is_ai_generated is True or None, never asserted False -- stripped
metadata leaves no local proof of a clean origin, so absence of signals
is reported as 'unknown' with an explicit caveat. The SynthID *pixel*
watermark remains locally undecodable; the report says so.

Non-PNG containers (JPEG/WebP/AVIF/HEIF/JXL) get the same issuer +
generator attribution via a binary scan (the caBX parser is PNG-only).
The cv2 dependency is isolated in gemini_engine.detect_sparkle_confidence
so identify.py stays type-clean. CLI supports --json and --no-visible.

Validated against the 109-image corpus: 14/14 positives flagged AI,
93/94 negatives clean (the one 'neg' flagged is a Meta image that
genuinely carries the IPTC tag -- correct), zero true errors.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/remove_ai_watermarks/cli.py

@@ -8,6 +8,7 @@ Provides commands for:
 
 from __future__ import annotations
 
+import json
 import logging
 import time
 from pathlib import Path
@@ -329,6 +330,55 @@ def cmd_metadata(
     console.print(f"  [green]✓[/] AI metadata stripped → {out}")
 
 
+# ── Provenance identification ───────────────────────────────────────
+
+
+@main.command("identify")
+@click.argument("source", type=click.Path(exists=True, path_type=Path))
+@click.option("--no-visible", is_flag=True, help="Skip the visible-sparkle detector (metadata-only, no cv2).")
+@click.option("--json", "as_json", is_flag=True, help="Emit the report as JSON instead of a table.")
+@click.pass_context
+def cmd_identify(ctx: click.Context, source: Path, no_visible: bool, as_json: bool) -> None:
+    """Identify where an image was made and what watermarks it carries.
+
+    Aggregates C2PA Content Credentials, IPTC "Made with AI" tags, embedded
+    generation parameters, the SynthID metadata proxy, and the visible Gemini
+    sparkle into a single provenance verdict. Absence of signals is reported as
+    "unknown", never as "clean" (stripped metadata leaves no local proof).
+    """
+    from dataclasses import asdict
+
+    from remove_ai_watermarks.identify import identify
+
+    source = _validate_image(source)
+    report = identify(source, check_visible=not no_visible)
+
+    if as_json:
+        click.echo(json.dumps(asdict(report), default=str, indent=2))
+        return
+
+    _banner()
+    verdict = {True: "[yellow]AI-generated[/]", False: "[green]not AI[/]", None: "[dim]unknown[/]"}[
+        report.is_ai_generated
+    ]
+    console.print(f"\n  Verdict: {verdict}  [dim](confidence: {report.confidence})[/]")
+    console.print(f"  Platform: {report.platform or '[dim]undetermined[/]'}")
+
+    if report.watermarks:
+        table = Table(show_header=True, header_style="bold", title="Watermarks / provenance markers")
+        table.add_column("Marker", style="cyan")
+        for wm in report.watermarks:
+            table.add_row(wm)
+        console.print(table)
+    else:
+        console.print("  [dim]No watermarks or provenance markers found.[/]")
+
+    if report.caveats:
+        console.print("\n  [dim]Caveats:[/]")
+        for c in report.caveats:
+            console.print(f"  [dim]- {c}[/]")
+
+
 # ── Combined "all" mode ──────────────────────────────────────────────