Cost ledger: every finished run appends one hash-chained cost entry, and a script verifies the chain #12112

Split from #1386 (parked twice; the tries went red as they spread into the home lanes, flow and design files). This is the core only: the entry and the chain, no git, no pages.

Done when:

• When a run ends (agent, check, deploy, snapshot), one entry {run, kind, repo, issue, pull, startedAt, endedAt, wall_s, tokens_in, tokens_out, usd_tokens, prev, hash} is appended to $FORGE_DATA/ledger/<yyyy-mm>.jsonl; hash is sha256 over the canonical (sorted-key) entry without hash, prev is the previous entry's hash (the first is 64 zeros). Fields the run does not know yet (cpu, memory, lane wait) are absent, not zero.
• Appends are serialised in-process so two runs ending together never share a prev.
• bun scripts/ledger-verify.ts [dir] walks the chain and prints ok N entries or the first broken line and why, exiting 1 on a break.
• Tests (test/ledger.test.ts): a run that ends writes one entry; two ends in a row chain; editing one field breaks verification at that line; a day with no runs writes nothing.
• docs/features/cost-ledger.md says what an entry holds and how to verify.

Files: new src/core/ledger.ts, the run-finish path in src/core/runs.ts (one call), scripts/ledger-verify.ts, the test, the doc. Touch nothing in src/flow/, src/web/ or docs/design/. scout/1386-a-cost-ledger-per-delivery-tokens-comput at 169230c70b91 has a src/core/ledger.ts worth reading.

Risk: the finish path is hot; the append must not throw into it (log and carry on).