the ledger: a caller's own bedikot, read back and signed

The examination is the product; the record of it is what a caller can
carry away. Every bedikah was already engraved in L3 — output hash and
length, source digests, coupling trace, claims, violations, verdict,
never the text — and no caller could get theirs back.

- bedikot.key_id (migration): a SHA-256 digest of the courtyard key that
  brought the offering, never the key; threaded as :key_id through
  Bedikah.examine from every site that goes through the gate (courtyard
  bedikah, pair, the gate's pass and stream). Unique index on
  bedikah_ref.
- VavPipeline.Ledger: entry (the examination's fields, none of the
  database's, not the owner's), canonical JSON (keys sorted at every
  level, no whitespace, UTF-8), Ed25519 sign/verify, public key, render.
  Seed from BIKORET_LEDGER_SIGNING_KEY (base64 of 32 bytes) in
  shorashim-secrets; absent → unsigned and says so.
- GET /courtyard/ledger?limit&before — this key's bedikot, newest first,
  each rendered and signed; GET /courtyard/bedikah/<ref> — one, 404 for
  another key's or none alike; GET /peah/ledger_key — the public key.
- Tamid §1.1 "The ledger" (Doorpost pin moved → 02ddf313…), KOHEN
  "Issuing a key" (the seed, once), secrets.yaml template.

Tests: ledger_test (digest, entry, canonical, sign/verify, unsigned
rendering, signed rendering); ledger_l3_test (own records listed newest
first and only own; 404 alike for another's and none; an examination
engraved under the key reads back signed and verifies against
/peah/ledger_key). Elixir 642/0; L3 13/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/config/runtime.exs

@@ -51,5 +51,8 @@ if config_env() == :prod do
     # and says so only in a warning line.
     shoresh_engine_binary:
       System.get_env("SHORESH_ENGINE_BINARY") || "shoresh-engine",
-    http_port: String.to_integer(System.get_env("HTTP_PORT") || "4000")
+    http_port: String.to_integer(System.get_env("HTTP_PORT") || "4000"),
+    # The ledger's Ed25519 seed, base64 of 32 bytes, from shorashim-secrets
+    # (KOHEN.md, "Issuing a key"). Absent → records are given unsigned and say so.
+    ledger_signing_key: System.get_env("BIKORET_LEDGER_SIGNING_KEY")
 end