Cost ledger: snapshots append an entry too #12291

A snapshot that ends now appends one cost-ledger entry, whether it landed or failed. The gate, tsc, the new cost-ledger tests and the backup tests I ran all pass.

What changed

• src/snapshot/service.ts calls appendSnapshot from src/core/ledger.ts when a snapshot lands and when it fails. Both are tied to the start time and end time the snapshot service already had.
• A snapshot entry has kind: "snapshot", run: "snapshot:<startedAt>", startedAt, endedAt and wall_s. A failed one also carries failed: true; that field is absent otherwise.
• The entry joins the same hash chain as run entries, through the same appendBody helper, so ledger-verify still passes.
• A forge with nowhere to put a snapshot writes nothing, since it never took one.
• Repo for an instance-wide snapshot: the entry has no repo. A snapshot belongs to the whole forge, and inventing a repo id would be false data. So LedgerEntry.repo is now optional, in keeping with the rule that fields a run doesn't know are absent. Run entries still always set it.
• docs/features/cost-ledger.md describes the snapshot entry.
• test/cost-ledger-snapshot.test.ts covers three cases: a landed snapshot writes one entry with no repo and the chain verifies, a failed one is marked failed, and no store writes nothing.

Left out

• No usd_tokens or tokens_* on snapshot entries: a snapshot has no model cost.
• No byte or object counts on the entry. They are in the manifest and can be added if the ledger should carry them.

I did not run the full suite. The forge's check runs it on this push.

Closes #12256

A snapshot that ends now appends one cost-ledger entry, whether it landed or failed. The gate, tsc, the new cost-ledger tests and the backup tests I ran all pass.

What changed

• src/snapshot/service.ts calls appendSnapshot from src/core/ledger.ts when a snapshot lands and when it fails. Both are tied to the start time and end time the snapshot service already had.
• A snapshot entry has kind: "snapshot", run: "snapshot:<startedAt>", startedAt, endedAt and wall_s. A failed one also carries failed: true; that field is absent otherwise.
• The entry joins the same hash chain as run entries, through the same appendBody helper, so ledger-verify still passes.
• A forge with nowhere to put a snapshot writes nothing, since it never took one.
• Repo for an instance-wide snapshot: the entry has no repo. A snapshot belongs to the whole forge, and inventing a repo id would be false data. So LedgerEntry.repo is now optional, in keeping with the rule that fields a run doesn't know are absent. Run entries still always set it.
• docs/features/cost-ledger.md describes the snapshot entry.
• test/cost-ledger-snapshot.test.ts covers three cases: a landed snapshot writes one entry with no repo and the chain verifies, a failed one is marked failed, and no store writes nothing.

Left out

• No usd_tokens or tokens_* on snapshot entries: a snapshot has no model cost.
• No byte or object counts on the entry. They are in the manifest and can be added if the ledger should carry them.

I did not run the full suite. The forge's check runs it on this push.

The check failed on one over-long comment line in src/core/ledger.ts: line 153 was 106 columns against the gate's 100. I rewrapped the doc comment over snapshotEntryOf to three lines, with no other change, and pushed.

bun scripts/gate.ts passes on a rerun (empty output) and tsc --noEmit is clean. The cost-ledger tests pass: 14 across 2 files.

The first gate run in the same command still showed the old error, but that was only output captured before the edit landed. I did not rerun the backup tests, since the change is comment-only; the forge's check runs the full set on this push.