feat(authz): CVA contract — policy-satisfaction binding + replay resistance (#252)

[tcconnally]

Summary

Implements #252: the CVA (Cryptographically Verifiable Agent Authorization) property contract from arXiv:2607.21325, applied to Ledger's AAR prebind. Authorization satisfaction becomes a signed, bound claim — request hash + policy hash + context hash + nonce/epoch — instead of an asserted one, with the paper's six properties (authorization soundness, principal/request/policy/context binding, replay resistance) as acceptance criteria.

What changed

• ledger_agent/cva.py — build_cva_statement (the paper's statement x=(id, h_q, h_c, pid, n, t)); cva_relation_holds implementing R_CVA = BindPrincipal ∧ BindRequest ∧ BindContext ∧ SatisfyPolicy over Ledger's key_registry/request/context/policy primitives; is_fresh (paper eq. 38–40) and a CvaGateway whose accept consumes nonces only on full acceptance; a property-metadata table for spec/test parity.
• ledger_agent/receipts.py + ledger_agent/prebind.py — AAR receipts (prebind v2) now carry optional request_hash, nonce, epoch in the signed/hash-covered payload (backward compatible; policy_hash/context_hash already existed).
• tests/test_cva.py — one attack per property: soundness, principal binding, request binding, policy binding, context binding, replay resistance, timestamp window, nonce-burn semantics.
• tests/test_prebind_replay_api.py — authority-trace suite v2: CVA replay-resistance cases, including the key-rotation case (old-key witness fails principal binding; stale-context witness fails context binding; fresh witness under the rotated key accepts).
• docs/cva-contract-spec.md — formal R_CVA mapped to AAR prebind fields; CVA property matrix (property → paper eq → attack class → Ledger mechanism → acceptance criterion → test); the structural separation of identity / authorization-request / runtime-execution binding as the open problem (Request Commitment ≠ Internal Agent Intent); falsifiable research agenda (H1–H3); selective-disclosure zk-PoC (Groth16) feasibility lane with a receipts-first, proofs-where-required recommendation.
• docs/authorized-action-receipts.md — new "CVA property contract" section.

Success criteria (#252)

• AAR receipts carry policy-satisfaction binding: request hash + policy hash + context hash in the signed payload.
• Replay-resistance case passes in the authority-trace suite v2 (incl. key rotation).
• CVA property matrix spec merged; falsifiable hypotheses documented with the paper's agenda as grounding.

Closes #252