feat(safety): runtime-contract enforcement — trajectory schema + evidential gate (#250)

[tcconnally]

Summary

Implements #250: runtime-contract enforcement for agent safety (arXiv:2608.11274, "Agent Safety Should Be a Runtime Contract"). Adds the evidential face to Ledger — the Agent Trajectory Schema + Evidence Chain — and an evidence-gated submission contract. The preventive face is expressed as the compositional gating proposition over harness monitors; Ledger's existing receipts (#183/#220/#223/#224) are the durable substrate.

What changed

• ledger_agent/trajectory.py — Agent Trajectory Schema (Definition 1): hash-chained events (kind, timestamp, payload, hash) with the paper's event-type alphabet (tool_call, tool_result, file_read, file_write, shell_exec, commit, screenshot, citation_lookup, human_approval, model_message). Hard-vs-soft evidence classification (Definition 2) via a deterministic verifier registry; evidence-chain construction (Definition 3); fail-closed submission gate; ComposedGate for monitor+gates composition; trajectory_root_hash() for AAR receipt binding.
• docs/runtime-contract.md — schema, hard/soft evidence, evidence chain, submission gate, the compositional gating proposition (paper §4.3, stated formally: monitors with disjoint observation alphabets compose; assume-guarantee fallback; polynomial verification in the disjoint/sequential cases), preventive-face taxonomy, six evidence classes from the false-completion audit.
• examples/runtime_contract_demo.py — demo scenario: an evidence-less "done" completion claim is rejected; the same run with test_run + log_capture + citation_lookup evidence is accepted.
• tests/test_runtime_contract.py — chain integrity, tamper invalidation, hard/soft classification, evidence chains, gate accept/reject, monitor composition, demo regression.

Success criteria (#250)

• Trajectory schema serializes an agent run with evidence links; round-trip deterministic and diffable.
• Submission gate rejects evidence-less completion claims (demo + tests).
• Compositional gating spec merged with a formal proposition (docs/runtime-contract.md).

AAR integration

Trajectory root hash is attachable to prebind/receipt evidence_hashes — authorization decides whether an action may happen; the evidential face verifies that it happened; both can anchor in one receipt (issue item 4).

Closes #250