CelmConclusion class sealed

A conclusion a run reached, and how it reached it.

Two types rather than one type with a provenance string: a consumer that must separate what was measured from what was inferred cannot forget to, and a judgment cannot be constructed without naming the reasoner that made it.

The separation holds across serialization too. CelmConclusion.fromJson dispatches on provenance, and each subtype's factory refuses a record whose provenance is not its own — a judged record cannot come back from a store as an observation.