punkzip PROVENANCE.md: relative sibling-checkout convention replaces the dev-machine absolute path

The Origin section now names the upstream by its remote and expects the
working checkout at ../zig/punkzip relative to the punkshell repo root,
stated as a layout convention with its fallback spelled out (clone the
remote there; the pinned Vendored state commit identifies the exact
upstream state in any clone). The re-vendor procedure now runs entirely
from the punkshell repo root (git -C ../zig/punkzip checks, relative cp
sources), making it copy-pasteable on any machine reproducing the
sibling layout and independent of the punkshell checkout's own
directory name (survives the G-022 rename).

PROVENANCE.md was the only operational document carrying the
machine-local path - the c:/repo/jn absolute references in goals,
archives and CHANGELOG are historical narrative and stay as-is. G-135
names this file's prose as the src/tools vendored-tree convention, so
the relative form is set while there is one instance to copy.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

src/tools/punkzip/PROVENANCE.md

@@ -2,8 +2,12 @@
 
 ## Origin
 
-- Upstream repository: `c:/repo/jn/zig/punkzip` (git; remote
+- Upstream repository: punkzip (git; remote
-  `https://www.gitea1.intx.com.au/jn/punkzip`)
+  `https://www.gitea1.intx.com.au/jn/punkzip`). The working checkout is expected as
+  a sibling of this repository, at `../zig/punkzip` relative to the punkshell repo
+  root. That is a layout convention, not a requirement - if no checkout is present
+  there, clone the remote to that location; the Vendored state commit below
+  identifies the exact upstream state in any clone.
 - Vendored state: commit `0882f0373eb2c983142e713c814b91aa82cfcea7` (punkzip v2.3.1,
   2026-07-27; upstream working tree clean at copy time)
 - Vendored: 2026-07-27 for goal G-126 (see `goals/G-126-punkzip-accelerator.md`)
@@ -35,20 +39,19 @@ fork boundary stays clean and every vendored state corresponds to an upstream co
 ## Re-vendor procedure
 
 From a CLEAN upstream checkout (commit upstream first; a dirty copy has no committed
-provenance):
+provenance). All commands run from the punkshell repo root, with the upstream
+checkout at its expected sibling location `../zig/punkzip` (see Origin):
 
-    cd c:/repo/jn/zig/punkzip
+    git -C ../zig/punkzip status --short   # must be empty
-    git status --short              # must be empty
+    git -C ../zig/punkzip rev-parse HEAD   # record as the new Vendored state above
-    git rev-parse HEAD              # record as the new Vendored state above
 
-    # from the punkshell repo root:
     rm -rf src/tools/punkzip/src
-    cp c:/repo/jn/zig/punkzip/build.zig            src/tools/punkzip/
+    cp ../zig/punkzip/build.zig            src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/build.zig.zon        src/tools/punkzip/
+    cp ../zig/punkzip/build.zig.zon        src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/LICENSE              src/tools/punkzip/
+    cp ../zig/punkzip/LICENSE              src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/LICENSE-time-dot-zig src/tools/punkzip/
+    cp ../zig/punkzip/LICENSE-time-dot-zig src/tools/punkzip/
-    cp c:/repo/jn/zig/punkzip/README.md            src/tools/punkzip/
+    cp ../zig/punkzip/README.md            src/tools/punkzip/
-    cp -r c:/repo/jn/zig/punkzip/src               src/tools/punkzip/src
+    cp -r ../zig/punkzip/src               src/tools/punkzip/src
 
     # verify with the pinned toolchain (zig build test must pass; the gate is the
     # exit code - the zip suite's negative tests print EOCD warnings while passing):