the ledger: a caller's own bedikot, read back and signed

The examination is the product; the record of it is what a caller can
carry away. Every bedikah was already engraved in L3 — output hash and
length, source digests, coupling trace, claims, violations, verdict,
never the text — and no caller could get theirs back.

- bedikot.key_id (migration): a SHA-256 digest of the courtyard key that
  brought the offering, never the key; threaded as :key_id through
  Bedikah.examine from every site that goes through the gate (courtyard
  bedikah, pair, the gate's pass and stream). Unique index on
  bedikah_ref.
- VavPipeline.Ledger: entry (the examination's fields, none of the
  database's, not the owner's), canonical JSON (keys sorted at every
  level, no whitespace, UTF-8), Ed25519 sign/verify, public key, render.
  Seed from BIKORET_LEDGER_SIGNING_KEY (base64 of 32 bytes) in
  shorashim-secrets; absent → unsigned and says so.
- GET /courtyard/ledger?limit&before — this key's bedikot, newest first,
  each rendered and signed; GET /courtyard/bedikah/<ref> — one, 404 for
  another key's or none alike; GET /peah/ledger_key — the public key.
- Tamid §1.1 "The ledger" (Doorpost pin moved → 02ddf313…), KOHEN
  "Issuing a key" (the seed, once), secrets.yaml template.

Tests: ledger_test (digest, entry, canonical, sign/verify, unsigned
rendering, signed rendering); ledger_l3_test (own records listed newest
first and only own; 404 alike for another's and none; an examination
engraved under the key reads back signed and verifies against
/peah/ledger_key). Elixir 642/0; L3 13/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -513,6 +513,24 @@ BIKORET_WATCHDOG_DRY=1 bikoret-watchdog              # a probe that opens nothin
 
 ### Issuing a key — *Mishmeret HaSha'ar*
 
+**The ledger's signing key (once).** Callers read their bedikot back
+signed (Tamid §1.1, "The ledger"); the signature is Ed25519 over a
+32-byte seed the kohen makes and keeps in `shorashim-secrets`. Without
+it the ledger is served unsigned and says so.
+
+```bash
+umask 077; SEED=$(openssl rand -base64 32)
+kubectl -n shorashim patch secret shorashim-secrets --type=merge \
+  -p "{\"stringData\":{\"BIKORET_LEDGER_SIGNING_KEY\":\"$SEED\"}}"
+unset SEED
+bash ~/.local/bin/shorashim-rollout          # envFrom reads the Secret at start
+curl -s https://bikoret.ch/peah/ledger_key   # "signed": true, the public key
+```
+
+Rotating the seed invalidates every signature given before it; keep the
+old public key published beside the new if records must stay verifiable.
+
+
 The courtyard and the chatzer open only to a key you issued. Keys live
 in the `shorashim-api-keys` Secret, mounted as a file; the gate reads
 the file on every request, so a change takes effect within about a