refactor(ledger): extract korg-ledger — publishable single-source spec crate

[New1Direction]

Why

To ship the verifier as a clean cargo install korg-verify, korg-verify can't depend on the internal korg-registry path crate. It only uses one thing from it — ledger_chain (240 lines). So I extracted those chain primitives into their own standalone, publishable crate, korg-ledger, which is also the natural home for the korg-ledger@v1 spec implementation.

This avoids both bad alternatives: vendoring a 2nd copy of the hash code (drift risk), and publishing the entire internal runtime (korg-core/korg-registry) to crates.io.

Changes

• New crate crates/korg-ledger — canonicalize / chain_hash / verify_chain / verify_dag + GENESIS_HASH. Deps: serde_json, sha2, hmac only. The code moved verbatim (byte-identical, same SHA) so conformance is unchanged.
• korg-registry::ledger_chain is now a re-export of korg-ledger (pub use korg_ledger::*;). Every crate::ledger_chain::… caller (e.g. log.rs) is untouched — single source of truth, no duplication.
• korg-verify now depends on korg-ledger (one import swap). Its only internal path dep is gone → publishable standalone.
• Workspace members + Cargo.lock updated.

Test plan

• korg-ledger 3, korg-registry 23, korg-verify 15 (4 lib + 5 frozen conformance vectors + 6 receipt) — all pass
• clippy clean (0) on korg-ledger + korg-verify; fmt clean
• cargo publish --dry-run -p korg-ledger → Packaged + Verified green
• korg-verify dry-run correctly blocks on "no matching package korg-ledger" — confirms publish order

Publish (needs a crates.io token)

cargo publish -p korg-ledger      # first — self-contained
# wait for it to be live on crates.io, then:
cargo publish -p korg-verify      # now resolves korg-ledger

Then the launch command becomes cargo install korg-verify.