The provenance-1 constraint is defined on Provenance.agent.onBehalfOf. Therefore the "$this.agent" part of the constraint can't match any elements.

"(($this.agent.who.resolve() is Practitioner) or ($this.agent.who.resolve() is Device)) implies exists()"

should be changed to

"((%resource.agent.who.resolve() is Practitioner) or (%resource.agent.who.resolve() is Device)) implies exists()"

See https://chat.fhir.org/#narrow/stream/179166-implementers/topic/US-Core.20provenance-1