Caller-owned completed history submitted for ingestion.
Protected repos require an explicit audience: :repo or a nonempty list of
{organization_id, group_id} tuples. It is immutable, part of payload identity,
and inherited by every extracted node. Unrestricted repos use nil.