Cost ledger: the chain is committed to git in signed batches, so another forge can verify it #12113

Split from #1386. Git is truth; the jsonl is the spool.

Done when:

• At most once an hour, and only when there are new entries, the forge commits the new entries to the ledger branch of a repository it owns (one file per month, appended), signed with the forge's key, one commit per batch.
• bun scripts/ledger-verify.ts --git <repo-path> verifies the chain and the commit signatures from a clone, with no database.
• Tests: a batch makes one commit; no new entries make none; a rewritten entry in the git file breaks verification at that line.
• The doc from the first issue says where the chain lives and how to clone and verify it.

Files: a new src/core/ledger_git.ts, its timer registration, scripts/ledger-verify.ts, a test. Named timer per test/timers-named.test.ts.

Risk: writing to a repository from a timer; reuse the forge's existing commit helper, never shell out with entry text.