the ledger: a caller's own bedikot, read back and signed

The examination is the product; the record of it is what a caller can
carry away. Every bedikah was already engraved in L3 — output hash and
length, source digests, coupling trace, claims, violations, verdict,
never the text — and no caller could get theirs back.

- bedikot.key_id (migration): a SHA-256 digest of the courtyard key that
  brought the offering, never the key; threaded as :key_id through
  Bedikah.examine from every site that goes through the gate (courtyard
  bedikah, pair, the gate's pass and stream). Unique index on
  bedikah_ref.
- VavPipeline.Ledger: entry (the examination's fields, none of the
  database's, not the owner's), canonical JSON (keys sorted at every
  level, no whitespace, UTF-8), Ed25519 sign/verify, public key, render.
  Seed from BIKORET_LEDGER_SIGNING_KEY (base64 of 32 bytes) in
  shorashim-secrets; absent → unsigned and says so.
- GET /courtyard/ledger?limit&before — this key's bedikot, newest first,
  each rendered and signed; GET /courtyard/bedikah/<ref> — one, 404 for
  another key's or none alike; GET /peah/ledger_key — the public key.
- Tamid §1.1 "The ledger" (Doorpost pin moved → 02ddf313…), KOHEN
  "Issuing a key" (the seed, once), secrets.yaml template.

Tests: ledger_test (digest, entry, canonical, sign/verify, unsigned
rendering, signed rendering); ledger_l3_test (own records listed newest
first and only own; 404 alike for another's and none; an examination
engraved under the key reads back signed and verifies against
/peah/ledger_key). Elixir 642/0; L3 13/0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/priv/repo/migrations/20261021000001_bedikot_key_id.exs

@@ -0,0 +1,18 @@
+defmodule VavPipeline.Repo.Migrations.BedikotKeyId do
+  use Ecto.Migration
+
+  @moduledoc """
+  The ledger (2026-10-21): a bedikah remembers WHICH courtyard key brought
+  the offering — as a digest of the key, never the key — so a caller can
+  read back their own records and no one else's.
+  """
+
+  def change do
+    alter table(:bedikot) do
+      add :key_id, :string, null: true
+    end
+
+    create index(:bedikot, [:key_id, :examined_at])
+    create unique_index(:bedikot, [:bedikah_ref], name: :bedikot_bedikah_ref_unique)
+  end
+end