feat(training): record append-only export delivery outcomes

[DrAbdulmalek]

Summary

• Adds a metadata-only append-only delivery_events ledger for export lifecycle observations.
• Records push_started, push_succeeded, and push_ambiguous; records archive and queue-cleanup failures separately.
• Uses per-attempt correlation IDs and idempotent event keys; never stores medical payloads or credentials in delivery events.
• Adds tests for event idempotency/immutability and injected push/archive failures.

Safety and scope

• Stacked follow-up to PR feat(training): add content-bound approval and append-only export ledger #191; base is feat/training-integrity-ledger, not main.
• This PR does not address the separate multi-writer/lost-update risk tracked in Issue P2-A: Prevent lost updates during concurrent Hugging Face dataset exports #193.
• No live Hugging Face upload was performed; automated tests use mocks.
• Export remains disabled by default.
• Draft until fresh CI and independent review complete. Do not merge this PR before its base PR feat(training): add content-bound approval and append-only export ledger #191 is resolved.

[DrAbdulmalek]

Initial independent status note: this is a stacked, draft follow-up to PR #191, not a merge authorization. The delivery ledger is metadata-only and does not prove exactly-once delivery. At the time of this note, Secret Gate and HF Space Drift Gate passed; Docker was still in progress. Await fresh full CI and independent review. P2-A remains tracked separately in Issue #193. No live HF upload or change to main.