Spark compile-time verifier: any Ash.Resource listed in manifest.sensitive_resources must use AshPaperTrail.Resource.
Registered in the Foundry Spark DSL extension so it fires when the target project compiles. Violations surface as compile errors before any proposal is created. Mirrors SparkLint.Rules.PaperTrailRule but runs at compile time, not proposal submit.