feat: add isolated opt-in admission ledger core

[neonwatty]

Adds an isolated V2 admission core inside the existing app-scoped authority storage. It spends one durable signing permit, signs only in the owning live invocation, and commits the signed confirmation, immutable normalized result, and content-free pending marker together after rechecking current authority and time. Interrupted work becomes terminal failed-unconfirmed; it never signs again. Historical admitted results remain distinct from known signatures and UNKNOWN.

The private verifier requires an authenticated V2 token, original admitted ledger record, exact capability commitment and submission binding, current authority, and valid time. A signed candidate from before the admission commit is unusable. Tokens, API keys, roots, bearer secrets, and private signing keys are never persisted.

Publication/provisioning defaults unavailable. This adds no HTTP/RPC route, resource, configuration, credential, key publication, or external verifier/adapter integration. Existing V1 handling remains unchanged. The only existing-source edits coordinate P5 recovery/retention with the authority's one observation alarm.

The private pending interface supports exactly one immutable original-delivery join event per admission. A separately qualified producer must supply the original 13 delivery facts; P5 adds its stored normalized four-tuple. Reads retry the same 17-value command, and acknowledgement retains a tombstone through the original P5 deadline. P5 creates no delivery/outcome events and performs no SQL/provider dispatch. Delivery/P6 owns later transitions and the independent delivery-retention clock.

Validation:

• npm run validate: lint, formatting, type checks, and 2,430 tests across 148 files passed.
• make check: all repository gates passed.
• Actual Miniflare/workerd SQLite tests cover simultaneous retries, immutable scope/generation, capacity and handle collisions, signature-before-commit rejection, revocation and expiry across awaits, rollback/sync/alarm failures, four hard-restart boundaries, lost reply/ack, shared deadline with late accounting, purge and shared-alarm ordering.
• Strongest disproof: kill the runtime after the synthetic signer finishes but before it reports completion. The recovered row remains UNKNOWN, a captured signed candidate is rejected, and retry never signs again. Killing after the second durable commit preserves historical A=1 without returning a replacement token.
• Review regressions fixed clock rollback producing invalid confirmation ordering, scope key-order sensitivity, canonical HTTPS port rejection, and malformed credential error classification.
• Independent correctness, tests, contracts/types, silent-failures, comments/docs and simplification reviews completed; applicable follow-up reviews cleared the fixes. Native codex review --base bcad3e8f2d0579ced84ed17ff7da2c770eeb7e9c was attempted twice: its first patch-inclusion finding was independently rejected after staging all new files; its final run passed the 14 protocol tests but repeatedly stalled in sandboxed workerd startup and was stopped. Parent and independent-agent workerd runs passed; native runtime review is not claimed as complete.

One initial full-suite run had an unchanged uninstall retry-count test report 7 instead of 8. Its isolated 15-test suite and subsequent full runs passed; no uninstall files changed.

Base: bcad3e8f2d0579ced84ed17ff7da2c770eeb7e9c. Protocol input: frozen SDK e26320976d337582b8bb7dafcf9839efe1010774. Remaining gates include real authenticated original-authority publication/provisioning, qualified delivery join and destination acknowledgement, purpose-separated key publication, external V2 consumers, deployed inventory, and capacity/backup/restore qualification. No activation or deployment is included.

[neonwatty]

Final independent review is CLEAN for exact head de8e114 against base bcad3e8. Coordinator completed native and independent-role review; the native sandbox startup claim was independently falsified by an actual workerd test (142 ms, exit 0). All executable PR CI checks passed.

Non-blocking follow-up remains open: an unchanged uninstall retry-count test once observed 7 SQL calls instead of 8. It is neither fixed nor root-caused. Twenty traced actual SQLite/workerd replays each observed all 8 calls; subsequent full validation passed 2,430 tests across 148 files. On recurrence, preserve per-step response status, durable attempt count, storage/alarm state, and SQL transport trace before restarting. Local evidence: /tmp/bugdrop-p5-uninstall-investigation.md (SHA256 8f2874340a4c23d6db1e9e4be9b487c23fb508835b16b8b78361a03ecf2b416a).

Manager authorized protected merge-queue entry only at the expected head. No bypass, manual deployment, activation, credentials, or P6 expansion is authorized.