Generated output: provenance header (source SHA + version) + built-in --check + deterministic ordering

Generated output needs provenance metadata + a built-in staleness check

To trust generated code as a true build artifact (git-ignored, regenerated in CI/build instead of committed), consumers need to (a) detect drift and (b) prove an artifact was generated from a specific contract. typeDiagram gives us neither today, so we hand-rolled both in a wrapper script.

Asks

1. Provenance header in every generated file (as a language-appropriate comment): source path, SHA-256 of the source .td, typediagram version, and the --to/flags used. Lets CI assert "this artifact matches this contract" with a grep, and makes a stale checkout obvious.
2. First-class --check mode: typediagram --check --to LANG file exits non-zero (with a diff) if regeneration would change the output. We currently reimplement this in scripts/gen_contracts.py because the CLI only writes-or-prints.
3. Deterministic, stable ordering of types/fields/__all__ across runs and versions, so (1) and (2) are reliable rather than churn-prone.
4. Optional: --emit-hash to print just the content hash for cache keys / build fingerprinting.

Why

We want to delete generated DTOs from version control and regenerate them in the build — but only if the build can guarantee the regenerated artifact matches the committed contract. Provenance + --check + determinism are exactly the metadata that makes "generated code lives outside git" safe. Without it, a stale or mismatched artifact ships silently.

Start with the typediagram CLI output path and scripts/gen_contracts.py, which currently reimplements the staleness check. Use the requested provenance metadata, built-in --check behavior, deterministic ordering, and optional hash output as acceptance criteria, verifying that drift produces a non-zero result and useful diff.