Similar Items: Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems